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1 Introductional Rant 


If you don't know what programming a machine down to the metal is all about, go away! no really, this 
document is not for you! if you are seeking for advice on using existing solutions, such as SDKs or libraries, 
you will find little to none information that is of any use for you and you might only become frustrated by 
figuring out how little you know. If you however aren't afraid of numbers and want to dare jumping into 
the snake-pit of semi-accurate information based on guesswork done by a bunch of freaks - feel invited. 
this was made to give you what you need in the most compressed and visually pleasing form possible. Stuff 
that matters. 


11 Things that are in this document 


just about everything explicitly and specifically related to the gamecube hard- and software internals and 
its programming. everything inside the box is subject to be documented, may it be relevant for actual 
programming or not. its meant as a reference for everyone who wants to know in all possible detail what 
makes this thing tick. 


one more thing: please notice that this is a technical documentation which is presented for pure educational 
purposes and higher learning, and not a moral lesson. i have decided against leaving out any information 
since i believe that information by itself should not be crippled in any way. if you choose to abuse this 
information for any kind of illegal activities (PLEASE DON’T!) so be it, but don't bother me with it. 


1.3 Things that are not in this document 


several things were decided to not being put into this document because they didn't fit into the "technical 
documentation' type of concept. They may be documented separatly some time but not now and not here. 
These things are: 


> Tips on Emulating the Gamecube on another Host system (this kind of information is only useful for 
a very limited number of people, and additionally might be highly confusing and/or misleading for 
those who are writing actual gamecube programs) 


> Explanation of the PSO (Phantasy Star Online) Exploit that lets you run code on the Gamecube 
> Explanation of the Codes used with Datels Action Replay 


> Instructions on using any tools that let you upload and execute code on the Gamecube, or any other 
development related tools except anything related to setting up and using gcc as a cross-compiler 
targeted to the gamecube. 


anything related to gaming, cheat-codes and the like. (this is a tech-doc not a gaming FAQ!) 
information on using the datel action replay to patch itself in order to execute code. 


detailed and/or complete sourcecode, except when a formal explanation would just over-complicate 
things. (this is a documentation, not a code library) 


building and/or using a custom interface to connect a gamecube memory card to another host and 
read/write data 


anything related to playing/booting/copying pirated games (as you may have noticed, we do not 
support piracy!) 


some of these may be arguable, so if you think they should be here - probably along the lines of the 
appendix - don't hesitate to write the chapter in question and send it to me. i might include it if you write 
it, but other than that i won't care (there is still enough other stuff to complete). 
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1.3 Conventions 


[> we count bits starting from 0, the most significant bit of a byte is bit 7. when visualising a byte the 
most significant bit comes first (left), and the least significant bit comes last (right). 


> when dealing with 16- or 32 byte values all figures are in big endian byte order. this means that the 
most significant byte comes first (left), and the least significant byte comes last (right). 


Please notice that the above is different to what IBM is using in their PPC documents. They have the 
(to many people strange and wrong) idea of applying "big endian’ to the order of bits and showing 
them the other way around as we do in this document. 


D- if known (from patents or other freely available sources) we use the same terminology as Nintendo 
(or Macronix respectively) does, in particular we try to use the same names and abbreviations for 
hardware registers, signals and the like as a weak attempt of providing consistency with other existing 
documentation. 


> absolute memory addresses are shown as if the gamecube had been initialized by the original IPL 
and address translation had not been changed. For this matter we dont use physical adresses to avoid 
confusion for the majority of our readers. 


D- code snippets are in either real or pseudo C language. any logical or arithmetic expressions outside 
code snippets are loosely similar to C notation according to the following table: 


Description Symbol 
logical or bitwise AND & 
logical or bitwise OR | 
logical or bitwise exclusive OR E 


logical or bitwise NOT (inverse) ! 
equality or assignment - 


addition + 
substraction - 
multiplication * 
division / 


please notice that -outside code- we do not make a difference between logical and bitwise opera- 
tions. if in doubt the operation is bitwise, it should however be clearly visible from the context. 


1.4 legal Babble 


Everything in this Document has been reverse-engineered from legally aquired software (Games), pub- 
licly available Patents and Documentation for the sole purpose of writing interoperable Software. This is 
explicitly allowed (almost encouraged :)) by Sect. 1201 (f), Reverse Engineering exception of the DMCA. 
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2 Gamecube Hardware Introduction 


The GameCube is a powerful piece of hardware. The whole system is based on the IBM PowerPC Gekko 
processor and the custom ATI Flipper video system. The PowerPC Gekko processor is really just a Pow- 
erPC 750 with a few enhancements. 


2.1 enhanced PowerPC 750 Specification 


486 MHz internal processor clock 

200 MHz 64-bit bus width to main memory (1.6 Gigabytes per second maximum) 
32KB associative L1 Icache 

32KB associative L1 Dcache with 16KB data scratchpad 


Super-scalar microprocessor with five different execution units: 
> 2 integer units, 1 ЕРО, and 1 load\store unit and branch unit 


ОМА unit servicing 16KB data scratchpad. 

ОМА request queue - 15-entry. 

Write-gather buffer for writing graphics command lists to the video system. 
Embedded 256KB 2-way set-associative L2 unified cache. 

2 32-bit Integer Units (IU) 

1 FPU, 32 and 64-bit bus width 

The FPU supports Floating Point Paired Singles (FP/PS) 


Branch Unit provides static AND dynamic branch prediction 


Features Out-Of-Order execution which means that when an instruction delays because of data ac- 
cess, subsequent opcodes can continue to be decoded and executed. 


The enhanced PowerPC Gekko processor also contains many features for minimization of processor delays 
because of data accessing and for maximization of processing throughput: 

Non-blocking caches 

Branch prediction through use of the Branch Unit (BU) 

8-way set-associative caches 


256KB L2 transfer cache 


Out-of-order execution capabilities 


The instruction set of the PowerPC Gekko processor seems to be almost identical to the one of the PowerPC 
750 processor.The only visible differences at the moment are that the PowerPC Gekko processor has a few 
AltiVec\SIMD opcodes added to its final instruction set. 
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2.2 Consumer Units 
2.2.1 Nintendo 


2.211 HW1 НУ was an initial, buggy version of the GameCube hardware that wasnt sold at retail. 


2.21.2 HW2  HW2 is the first hardware that was sold in stores to the public. 


2.2.1.3 HW2 ’second edition’ The second edition models are missing the "Serial Port 2" that the first 
edition had. The plastic cover is still on the bottom of the cube, where the port used to be, but there’s just 
a metal plate underneath it, and no connector. 


2.21.4 HW2’third edition’ The third edition Gamecubes are missing both the "Serial Port 2", and the 
Digital A/V connector. 


2.2.2 Panasonic Q 


There is a Gamecube combined with dvd-player manufactured by Panasonic called 'Panasonic-Q'. It seems 
to be exactly the same as HW2 for the Gamecube part, except that the dvd drive is different. 


2.3 Development Units 


Nintendo provides development hardware units to official, licensed GameCube developers. There are 
namely two different versions: the GDEV and the DDH hardware development kit units. These units 
are the same as retail GameCube HW2 units with some changes: They have PC communications features 
(either through SCSI or USB) and they have DVD emulation hardware instead of a proprietary mini-DVD 
drive. GameCube development units also seem to have slower processor speeds than retail GameCubes, 
this clock speed ranges from around 150MHz to 400MHz. Development GameCubes also seem to con- 
tain more RAM than retail ones, namely around 40MB. SNSystems also provides their own development 
kit,authorized by Nintendo, called the TDEV. According to specifications directly from SNSystems, the 
TDEV development hardware contains twice as much memory as retail GameCubes for debugging and a 
direct PC«-» TDEV USB connection for fast uploading of code and\or data. Finally, there is also another 
proprietary development kit called the NR-Reader. NR-Reader's contain less debugging capabilities than 
the other development kits and are mostly meant for developers to efficiently get their demos\games to 
beta testers or media. However, SNSystems reports that their ProDG development kit can be used with 
a special USB adapter of theirs for directly sending program (debug) code to NR-Reader GameCubes. 
Also, NR-Reader GameCubes contain different mini-DVD drives than retail GameCubes, but still use a 
proprietary writing\reading format which is currently unknown. The DVD drives of NR-Readers can only 
read special DVDs that can only be written correctly with NR-Writer hardware (which is really just a 
Panasonic\Matshita SW-9501 with modified firmware). Also, the official debug development kits possibly 
contain J-TAG support, which is a method for debugging hardware. If so, there is a possibility that J- TAG 
support still remains in retail GameCubes as well, but this is purely hypothesis. If, in fact, retail Game- 
Cubes contain J-TAG debugging support then it should be possible for (homebrew) code to be uploaded 
through a J-TAG cable) directly to a GameCube's RAM and executed. 


2.4 Hardware Parts List 


D "МВО" апа "MBB" will be used to refer to parts on the top and bottom sides of the GameCube's 
mother-board respectively. 
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> "DVDB" will be used to refer to parts on the DVD controller board. 


> "CB" will be used to refer to parts on the controller pad board. 


2.4.1 Connectors 


The are 10 different connectors on the GameCube’s mother-board. The following table contains an ID key 
and a short functional description. 


ID | Description 

P1 | Motherboard Power Connector - MBB - Top Left 

P2 | Digital Video Output Connector - MBU - Bottom Left 
P3 | Controller Pad Board Connector - MBU - Middle Right 
P4 | Memory Card Slot Connector A - MBU - Top Right 

P5 | Memory Card Slot Connector B - MBU - Bottom Right 
P6 | Serial Port Connector 1 - MBB - Top Right 

P7 | Analog Video Output Connector - MBU - Middle Left 
P8 | Serial Port Connector 2 - MBB - Top Right 

P9 | Mini-DVD Drive Port Connector - MBU - Top Right 
P10 | Hi-Speed Parallel Port Connector - MBB - Bottom Left 


pin | Signal 
] | EXTIN 
2 | GND 
3 | INT 
4 | 3.3V 
5 | DO 
2.411 Memory Card Slots (P4,P5) 6 | 5V 
7 | DI 
8 | 3.3V 
9 | CS 
10 | Ground (Shield) 
11 | CLK 
12 | EXTOUT 
pin | Signal 
1 | 3.3V 
2 | GND 
3 | INT 
2.4.1.2 High-speed Port (P8) 4 | CLK 
5 | DO 
6 | DI 
7 | CS 
8 | Ground (Shield) 
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2.4.1.3 SDRAM/Parallel Port (P10) 


2.41.4 BBA/Modem Connector (P6) 


pin | Signal 
1 VCC 
2 | Ground 
3 | DQO 
4 | DQ7 
5 | DQI 
6 | DQ6 
7 |DQ2 
8 | DQ5 
9 | DQ3 
10 | DQ4 
11 | VCC 
12 | Ground 
13 | write enable 
14 | DOM 
15 | CAS 
16 | Clock 
17 | RAS 
18 | A12 
19 | CS (Chip Select) 
20 | All 
21 | BAO 
22 | A9 
23 | BAI 
24 | A8 
25 | А10 
26 | A7 
27 | AO 
28 | Аб 
29 | Al 
30 | А5 
31 | А2 
32 | А4 
33 | АЗ 
34 | INT 
35 | VCC 
36 | Ground 
pin | Signal 
1 | EXTIN 
2 | Ground (Shield) 
3 | INT 
4 | CLK 
5 12V 
6 | DO 
7 | 3.3V 
8 | 3.3V 
9 | DI 
10 | CS 
11 | Ground 
12 | Ground 
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2.4.1.5 DVD Interface Connector (P9) 


pin | Signal 
1 AISLR (audio bus) 
2 | 5V 
3 | AISD (audio bus) 
4 | 5V 
5 | AISCLK (audio bus) 
6 | 5V 
7 | DIHSTRB 
8 | 5V 
9 | DIERRB 
10 | Ground 

11 | DIBRK 

12 | DICOVER 
13 | DIDSTBR 
14 | DIRSTB 
15 | DIDIR 

16 | Ground 

17 | DID7 

18 | Ground 

19 | DID6 

20 | Ground 

21 | DIDS 

22 | Ground 

23 | DID4 

24 | Ground 

25 | DID3 

26 | Ground 

27 | DID2 

28 | MONI 

29 | DIDI 

30 | MONOUT 
3] | DIDO 

32 | Ground 


23 


2 GAMECUBE HARDWARE INTRODUCTION 


pin | Signal 
1 Ground 
2 | Ground 
3 | 3.3V 
4 | 3.3V 
5 | Ground 
6 | Ground 
7 | Ground 
8 | Ground 
9 | 1.8V 
10 | 1.8V 
2.4.1.6 Power Supply Connector (P1) 11 | 1.8V 
12 | 1.8V 
13 | 1.55V 
14 | 1.55У 
15 | 1.55V 
16 | Ground 
17 | Ground 
18 | Ground 
19 | Thermo detect 
20 | 12V 
21 | 5V 
22 | 5V 


2.4.2 Semi-Conductors 


ID | Description 

01 | Customized NEC Flipper Chip - МВО - Middle 

02 | Customized IBM PowerPC Gekko Chip - MBU - Bottom 

03 | MoSys (MS3M23B-5 А) 12MB 1-T SRAM - MBU - Top Right 
04 | MoSys (MS3M23B-5 А) 12MB 1-T SRAM - MBU - Top Right 
05 | NEC (D4891281G5 0125XU621) 16МВ ARAM - МВЦ - Top Left 
06 | AW Encoder (AVE М -DOL RS5C5828) - MBB - Middle Left 
U7 | Amplifier? (AMP - DOL 128 124) - MBB - Top Left 

U8 | MX Clock Generator (Part Number?) - MBU - Bottom Left 

09 | MX Clock Generator (Part Number?) - MBU - Bottom Right 
010 | MX RTC/IPL (8013108-M RTCN-DOL 1R6022A1) 
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Pin | Signal 
1 Clock 
2 
3 
4 
5 | CS 
6 serial in 
2.4.2.1 IPL (010) 7 | Ground 
8 
9 serial out 
10 
11 


12 | osc - xtal2 
13 | osc - xtall 


2.5 Details on the motherboard buses 


The GameCube has three main external buses on its mother-board: the North-Bridge, the South-Bridge, 
and the East-Bridge. The fastest bus is the South-Bridge which connects the two 12MB 1T-SRAM chips 
to the Flipper. The South-Bridge bus has a bus-width of 64 bits, and data is exchanged through it at rates 
of about 324MHz. The North-Bridge bus connects the IBM PowerPC Gekko processor to the Flipper and 
is another 64 bit bus-width bus, however, it is only half as fast as the South-Bridge bus and is clocked at 
around 162MHz. Finally, the East-Bridge bus connects the 16MB Audio RAM chip to the Flipper chip. 
This bus only has a bus-width of 8 bits and is by far the slowest one, clocked at only 81MHz. 


2.6 Details on the Macronix (MX) Chips 


An outer inspection of the two MX chips does not reveal anything of much interest. Both chips are TSOP 
packages containing 14 pins each. One of the chips has "CLK" inscripted on it, and the other "RTC". It 
can be easily inferred that the "CLK" chip functions as some sort of a clock controller generator and the 
"RTC" chip contains the GameCube's Real-Time Clock unit. Two of the RTC chip’s pins are connected to 
an external crystal which regulates the RTC's timing rate. Another pin is connected to a battery located on 
the controller board. At least two pins are used for both VCC and GND. That leaves nine unknown pins. 
The RTC MX chip also contains the GameCube's BIOS. While 14 pins is not nearly enough for parallel 
Flash ROM, EEPROM, mask ROM, etc., it is quite adequate for a serial connection. 


2.7 DVD Protection 


The DVD Protection is based on a custom data format on an otherwhise pretty standard dvd. 


2.7. Filesystem 
The custom Filesystem (which is described somewhere else in this Document) by itself is not related to the 


actual protection mechanism. However, since it is not standard, that alone would already make it hard to 
read (and create) in a regular (pc-) environment. 


2.7.2 Barcode 


The Barcode is used to authenticate the Disc in the Drive. 


2 GAMECUBE HARDWARE INTRODUCTION 26 


2.7.5 Encryption 


The entire content of a Gamecube DVD is XORed with a constant cyphertext and it is transparently de- 
crypted by the Disc-Controller when reading from the DVD. 


2.7.31 Cyphertext algorithm (ойо 


2.8 IPL/BIOS Encryption 


if you XOR an NTSC with a PAL bios (or any other two different ones), you will notice that because they 
have different sizes, there are some obviously zero encoded areas in one files, giving you plaintext in the 
other one which proves: 


> encryption is a simple ХОК with a constant ciphertext. 

> the key used to generate the cyphertext is the same for different bios’s 
so we do the math: 
given Ci = ciphertext, Cl = cleartext, K = key 
encoding data goes like: 


Cil=Cl11 ^K 
С12 = C12 ^K 


If C11 or СР is nothing but zero, the resultant Ci is just K 
decoding it would be: 
Cl=Ci^K 


for the areas where Cl is nothing but zeroes in one bios, we know K 


2.8. Flipper decryption logic bug 


The hardware decryption logic has a really nasty bug which allows us to read almost the full Cleartext (and 
thus a large part of the cyphertext, by XORing it with encrypted data). 


This, combined with the features of the XOR encryption makea the whole encryption useless (at least 
very insecure) and implementing a new bios is a straight-forward task (provided that "high speed" (30Mhz) 
programmable logic with enough memory attached to it is available.). The Bios chip, which also includes 
sram and rtc (but that won’t matter here), is attached to the EXIO bus. The Exi bus (nothing new here, just 
to refresh it is an SPI-like bus. SPI is nothing complicated, just four interesting lines: CS (used mainly for 
syncing, since you need a defined start point, and you can easily attach multiple devices (memory card, ...) 
to the same bus with seperate CS lines), SI (aka MOSI, master out, slave in - the CPU is always master, the 
IPL-chip is slave. so SI is gamecube -> device), SO (device -> gamecube, tristated when a device is not 
active), and CLK (generated by the master). a transfer is basically: 


- lower CS (it’s low active) 


2 GAMECUBE HARDWARE INTRODUCTION 27 


for every bit do: 

- set SI bit 

- clock 

- read SO bit 

then: 

- put CS high again. 


(the exact timing (WHEN to sample SO, clock polarity) is different for different SPI modes, and the one 
descriped here is not necessarily the one used in the GC. anyway, it doesn’t matter here) 


so, based on that, we can transfer n-bit messages in BOTH DIRECTIONS. technically this is implemented 
with a 32bit shift register, with every clock cycle one bit is shifted out (to SD, and one bit is shifted in (to 
SO). so after n clock cycles, you have n new bits in the shift register and shifted n bits out. the used protocol 
on the Bus is in most cases very simple but device dependant. In the case of the IPL chip, it’s the following: 


GC -> IPL 

1 bit read/write (0 for read, 1 for write, the latter only valid for RTC/Sram of course) 

1 unknown bit 

1 bits selection (О for ROM, 1 for RTC/Sram) 

23 bits address 

6 bits dummy 

after that, the data transfer starts. the 6 dummy cycles are mainly to give the IPL time to read out the first 
byte. 


So you send 32 bits of data (the "address"), and start receiving the ROM bytes. but hey - we said the 
SPI bus always transfers 2 bits per clock cycle (in marketing terms), since it’s fullduplex (in technical 
terms). we transfer one bit TO the device, and one BACK. we HAVE to. there’s no way to NOT send a 
bit - but it doesn’t matter, since for example the bits send from the IPL to the GC in the first 32bits are 
just ignored - they would contain most probably only zeros, ones, or the bus might be tristate. it’s simply 
not defined, so there’s no data to be expected. the same goes for the transfer of the data. the IPL chip sets 
the correct data at the SO line, but the gamecube - well, sends dummy bits, too. normally you would send 
zeros, ones, or whatever. it’s ignored by the IPL chip anyway (unless it’s a write, that would turn the whole 
thing upside down) now since technically the SPI port is implemented by a shifting register of 32bit length. 
after transferring 32bits, we would have to read out the new value, store it into memory, and "start the next 
transfer". but what’s about CLEARING the register before? yes, they didn’t. in the next transfer, the last 
32bit are shifted out as dummy bits. well, one might say, it’s just the data just shifted in, so it’s completely 
uninteresting. BUT: the decryption of the loader is done in hardware. it’s a part between the SO line of 
the IPL and the DI port of the shift register. (the encryption is build into the flipper, so no way to intercept 
the content AFTER decryption).so because the (decrypted) data just shifted in (and stored into memory) is 
shifted out again - we can get the decrypted data. if you sniff the SI line to the IPL chip, you will get a log 
like this: 


00 00 40 00 (address written to the IPL, in this case: 0х100) 
FF FF FF FF (well just dummy data) 
XX XX XX xx (the data from the last 4 bytes, decrypted) 


хх XX хх XX (the data from the n-1 transfer, decrypted) 
so in the end you get every 32bit words except one. For every transfered block you miss 32bits of plaintext 


data, but you’ll get the rest. This should be enough to decrypt huge parts of the bios, and thus recover a 
large part of K. 
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2.8.2 Cyphertext algorithm 


todo 


2.8.3 replacing the IPL 


using the above gained knowledge it is possible to create a small bootrom replacement (using the, yet in- 
complete, cyphertext), and get more (most) of the IPL Cleartext. 


The Gekko boots from 0x100, that’s what you read in almost any ppc instruction manual - the reset vector. 
well, this isn’t the complete truth - it boots from it’s exception base + 0x100. And the exception base is 
normally zero, BUT, as the ppc manual states: there’s a bit in a HID (i think) register, which turns the 
exception base to OxFFF00000. and this bit is "set usually at boot time". So the processor starts to fetch 
instructions at OXFFF000100. If you read a bit further, you'll notice that the CPU always reads 64bits at 
once for code. The memory at OXFFF00000 is mapped inside the flipper to an automated exi transfer (with 
that shift register), with the decryption logic active. so the processor starts executing the decrypted instruc- 
tions, reading 8 bytes at a time, of which we get 4 bytes in plain - not much, (although enough to make 
some funny experiments, but that's another topic). Luckily, the IPL itself (the cube menu) isn't executed 
this way since that wouldn't be possible thanks to the "dumb" decryption logic The first -0x800 bytes start 
to read data out of the IPL chip and store it to memory (still using the hardware decryption logic), and 
jump there. they read 1024 bytes at once. Well - now we know 1020 bytes of each transfer, enough to have 
a complete block of code we can exchange (we have the ciphertext CI^K = Ci on SO, and the plaintext 
(delayed by 32bits on SI), and can XOR them to get CI^K^Ci = K. now we can encrypt our code with K). 
so now we can make a small code which just dumps the whole IPL - well, to the EXI bus or whereever you 
can receive it. Now we have all Cl, and thus we can compute all K, thus we can get the complete Plaintext 
of all available IPLs aswell as encode a larger custom IPL ourselves. 


a small note on why you can not recover the plaintext of the original loader this way: 


The decryption logic is, whatever it is, a PRNG. It generates a stream of ciphertext ("K"), which has random 
properties (non-repeating, at least not in the range of some MB), but is always the same. it is incremented 
with every EXI-transfer. the address is NOT used in the calculation. thus reading from OxFFF00100 more 
than one time will give you each time another result. the first time you get Ci(0)^K(0) (the correct result), 
the second time you get Ci(0)^K(1) etc., i.e. wrong results. Since we never get the K(n) for odd n, i see no 
chance of recovering it this way, even if we can read at OXFFF00000-x (and we can do this if we don't set 
a specific bit to disable the logic). 
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3 Gekko CPU Overview 


3.1 Registers 
> General purpose registers (r0-r31) 


> rl sp stackpointer 
> 12 rtoc global pointer to SDA2_BASE_ 
> r13 global pointer to _SDA_BASE_ 


> Floating point registers (fp0-fp31) 
> Segment registers (srO-sr15) - unused in regular (SDK/DolphinOS) applications 
> Special purpose registers ($рг0-$рг1023) 

> Spr8 (Ir) - link register 

> spr920 - HID2 


> spr1010 - instruction breakpoint address 


> spr1013 - data breakpoint address 


spr920 | 4 | r/w | HID2 


31 24123 16 1587 Q 


bit(s) description 
2 PSE - Paired-Single load and store instructions enabled 
1 
0 LSQE - Paired-Single mode enabled 


3.2 Calling conventions 


parameters are passed in r3 (150) r4 (2nd) and r5 (third) up to r12 (9th), further parameters are passed 
through the stack. 
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3.3 PPC Instructions 


3.31 Integer Instructions 


Mnemonic 


Opcode 


Description 


addi 
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Mnemonic 


Opcode 


Description 


andi 


andis 


ori 


oris 


nor 


eqv 


andc 


orc 


Mnemonic 


Opcode 


Description 


extsb 


extsh 


cntlzw 


rlwinm 


rlwnm 


rlwimi 


slw 


srw 


srawi 


Sraw 
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3.3.2 Floating-Point Instructions 


т 


Mnemonic 


Opcode 


Description 


fadd 


fadds (*) 


fsub 


fsubs (*) 


fmul 


fmuls (*) 


fdiv 


fdivs 


fres (*) 


frsqrte 


fsel (*) 


add 


Fh} eh} eh] hj Eh} Eh] Eh] Fh 


fneg 


fabs 


fnabs 


) - modified for paired singles 
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3.3.3 Integer Load and Store Instructions 


Mnemonic 


Opcode 


Description 


lbz 


lbzx 


lbzu 


lbzux 


lhz 


lhzx 


lhzu 


lhzux 


lha 


lhax 


lhau 


lhaux 


lwz 


lwzx 


lwzu 


lwzux 


stb 


stbx 


stbu 


stbux 


sth 


sthx 


sthu 


sthux 


stw 


Stwx 


stwu 


Stwux 


lhbrx 


lwbrx 


sthbrx 


Stwbrx 


lmw 


stmw 


lswi 


lswx 


stswi 


Stswx 
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3.3.4 Floating-Point Load and Store Instructions 


Mnemonic | Opcode | Description 
lfs 

lfsx 
lfsu 
lfsux 
lfd 

lfdx 
lfdu 
lfdux 
stfs 

stfsx 
stfsu 
stfsux 
stfd 
stfdx 
stfdu 
stfdux 
stfiwx 


3.3.5 Branch Instructions 


Mnemonic | Opcode | Description 
b unconditional Jump 


bl branch and link 


3.3.6 Condition Register Logical Instructions 


Mnemonic | Opcode | Description 
crand 
cror 


crxor 
crnand 
crnor 
creqv 
crandc 
crore 
mcrf 
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3.3.7 Misc Instructions 


Mnemonic | Opcode | Description 
twi 
tw 
5С 
rfi 
tcrf 


СГХГ 
fcr 
tmsr 
fmsr 
tspr 
fspr 
lwarx 


StWCX. 
sync 
mftb 
eieio 


isync 
dcbt 

dcbtst 
dcbz 

dcbz 1 
dcbst 
dcbf 
dcbi 
icbi 
eciwx 


ecowx 
mtsr 
mtsrin 
mfsr 
mfsrin 
tlbie 
tlbsync 


3.4 additional Gekko Instructions 


The Gekko has some additional (and some modified respectivly) instructions in its Paired-single mode 
which are useful for fast vector and matrix calculations and which are analog to Intel (and other x86 series) 
processors "streamed instructions", known as SSE. This extension is unique for the Gekko processor and 
used to calculate two single-precision numbers ("floats" in C) in one clock cycle. The floating-Point Reg- 
isters of the Gekko (FPRs) are modified in the following way : one half is used for the first single number, 
and other for the second. These parts are named as "PSO" and "PS1". PS instructionset is divided into two 
parts : Load and Store Quantization and Paired-Single Arithmetic instructions. Load and Store Quantiza- 
tion instructions are used for fast integer-float type casting and some specific memory operations, using 
PSO and PS1 parts of FPR. If you try to execute any PS instruction without HID2[PSE] and HID2[LSQE] 
bit set, an illegal instruction exception will be generated. 
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3.4.1 ЕРК format in paired-single mode 


63 56 55 48 57 40 39 32 
LIII ЧТ ТЫР, TIIE ITEL ATIL ДЇ ДАШТ 
31 24 23 16 15 8 7 0 
0000 0000 0000 0000 0000 0000 0000 0000 
bit(s) description 
32-63 | 1 | PSI 
0-31 | O | PSO 

3.4.2 Arithmetic Instructions 
Mnemonic | Opcode Description 
ps_abs 000100 DDDDD 00000 BBBBB 01000 01000 R | absolute value 
ps_add 000100 DDDDD AAAAA BBBBB 00000 10101 R | add 
ps_cmpo0 000100 DDD00 ААААА BBBBB 00001 00000 0 | compare ordered high 
ps_cmpol 000100 DDDOO AAAAA BBBBB 00011 00000 0 | compare ordered low 
ps_cmpu0Q 000100 DDD00 AAAAA BBBBB 00000 00000 0 | compare unordered high 
ps cmpul 000100 DDDOO AAAAA BBBBB 00010 00000 0 | compare unordered low 
ps_div 000100 DDDDD AAAAA BBBBB 00000 10010 R | divide 
ps_merge00 | 000100 DDDDD AAAAA BBBBB 10000 10000 R | merge high 
ps_merge01 | 000100 DDDDD AAAAA BBBBB 10001 10000 В | merge direct 
ps_mergel0 | 000100 DDDDD AAAAA BBBBB 10010 10000 В | merge swapped 
ps mergell | 000100 DDDDD AAAAA BBBBB 10011 10000 В | merge low 
ps_mr 000100 DDDDD 00000 BBBBB 00010 01000 R | move register 
ps_nabs 000100 DDDDD 00000 BBBBB 00100 01000 R | negate absolute value 
ps_neg 000100 DDDDD 00000 BBBBB 00001 01000 R | negate 
ps_res 000100 DDDDD 00000 BBBBB 00000 11000 R | reciprocal estimate 
ps rsqrte 000100 DDDDD 00000 BBBBB 00000 11010 R | reciprocal square root estimate 
ps. sub 000100 DDDDD AAAAA BBBBB 00000 10100 R | substract 
ps лада 000100 DDDDD AAAAA BBBBB CCCCC 11101 R | multiply and add 
ps_madds0 000100 DDDDD AAAAA BBBBB CCCCC 01110 R | multiply and add scalar high 
ps_madds1 000100 DDDDD AAAAA BBBBB CCCCC 01111 R | multiply and add scalar low 
ps_msub 000100 DDDDD AAAAA BBBBB CCCCC 11100 R | multiply and substract 
ps_mul 000100 DDDDD AAAAA 00000 CCCCC 11001 R | multiply 
ps mulsO 000100 DDDDD AAAAA 00000 CCCCC 01100 R | multiply scalar high 
ps mulsi 000100 DDDDD AAAAA 00000 CCCCC 01101 R | multiply scalar low 
ps. nmadd 000100 DDDDD AAAAA BBBBB CCCCC 11111 R | negative multiply and add 
ps nmsub 000100 DDDDD AAAAA BBBBB CCCCC 11110 R | negative multiply and substract 
ps sel 000100 DDDDD AAAAA BBBBB CCCCC 10111 R | select 
ps sum0 000100 DDDDD AAAAA BBBBB CCCCC 01010 R | vector sum high 
ps suml 000100 DDDDD AAAAA BBBBB CCCCC 01011 R | vector sum low 


Note : В opcode field (comparsion of result with zero) is unused. (20) 


3.4.21 PS ABS 


absolute value 


Clear bit 0 of PSO[B] and copy result to PSO[D] 


Clear bit 0 of PS1[B] and copy result to PS1[D] 
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3.4.2.2 PS_ADD ааа 
PSO[D] = PSO[A] + PSO[B] 


PS1[D] = PS1[A] + Р51 [В] 


3.4.2.3 PS СМРО0 compare ordered high 

"c" holds result of comparsion 

If (PSO[A] is NaN or PSO[B] is NaN) then c = 0001b 
Else if (PSO[A] < PSO[B]) then c = 1000b 

Else if (PSO[A] > Р50[В]) then с = 0100b 

Else c = 0010b 


Save result in D field of condition register (CR[D] = с). 


3.4.24 PS СМРО1 compare ordered low 
"c" holds result of comparsion 
ТЕ (РЅ1[А] is NaN or PS1[B] is NaN) then с = 0001р 


Else if (РЅ1[А] < PS1[B]) then с = 1000b 


Else if (PS1[A] > PS1[B]) then с = 0100b 
Else c = 0010b 
Save result in D field of condition register (CR[D] = с). 


3.4.2.5 PS CMPUO compare unordered high 
"c" holds result of comparsion 
If (PSO[A] is NaN or PSO[B] is NaN) then c = 0001b 


Else if (PSO[A] < PSO[B]) then c = 1000b 


Else if (PSO[A] > PSO[B]) then c = 0100b 
Else c = 0010b 
Save result in D field of condition register (CR[D] = с). 


3.4.2.6 PS CMPUI compare unordered low 

"c" holds result of comparsion 

If (РЅ1[А] is NaN or PS1[B] is NaN) then с = 0001р 
Else if (PS1[A] < PS1[B]) then с = 1000b 

Else if (PS1[A] > PS1[B]) then с = 01005 

Else c = 0010b 
Save result in D field of condition register (CR[D] = с). 


These four compare instructions looks same, because I omitted some 


unecessary FPSCR stuff. 
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3.4.2.7 PS DIV divide 
PSO[D] = PSO[A] / PSO[B] 
PS1[D] = РЅ1[А] / PS1[B] 


3.4.2.8 PS_MERGE00 merge high 
PSO[D] = PSO[A] 
PS1[D] = PSO[B] 


3.4.2.9 PS MERGEO1 merge direct 
PSO[D] = PSO[A] 
PS1[D] = PS1[B] 


3.4.2.10 PS_MERGE10 merge swapped 
PSO[D] = Р51 [А] 
PS1[D] = PSO[B] 


3.4.2.11 PS_MERGE11 merge low 
PSO[D] = Р51 [А] 
PS1[D] = PS1[B] 


3.4.2.12 PS MR move register 
PSO[D] = PSO[B] 
PS1[D] = PS1[B] 


3.4.213 PS NABS negate absolute value 
Set bit 0 of PSO[B] and copy result to PSO[D] 
Set bit 0 of PS1[B] and copy result to PS1[D] 


3.4.2.14 PS NEG negate 
Invert bit 0 of PSO[B] and copy result to PSO[D] 


Invert bit 0 of PS1[B] and copy result to PS1[D] 


3.4.2.15 PS RES reciprocal estimate 
PSO[D] = 1 / PSO[B] 
PS1[D] = 1 / PS1[B] 


3.4.2.16 PS RSQRTE reciprocal square root estimate 
PSO[D] = 1 / SQRT(PSO[B]) 
PS1[D] = 1 / SQRT(PS1[B]) 
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3.4.2.17 PS SUB subtract 
PSO[D] = PSO[A] - Р50 [В] 
PS1[D] = РЅ1[А] - PS1[B] 


3.4.2.18 PS MADD ітшіріу-ада 
PSO[D] = PSO[A] * PSO[C] + PSO[B] 
PS1[D] = PS1[A] * PS1[C] + Р51 [В] 


3.4.2.19 PS MADDSO multiply-add scalar high 
PSO[D] = PSO[A] * PSO[C] + PSO[B] 
PS1[D] = Р51[А] * PSO[C] + Р51 [В] 


3.4.2.20 PS MADDSI multiply-add scalar low 
PSO[D] = PSO[A] * PS1[C] + PSO[B] 
PS1[D] = PS1[A] * PS1[C] + PS1[B] 


3.4.2.21 PS MSUB multiply-subtract 
PSO[D] = PSO[A] * PSO[C] - PSO[B] 
PS1[D] = PS1[A] * PS1[C] - Р51 [В] 


3.4.2.22 PS MUL multiply 
PSO[D] = PSO[A] + PSO[C] 
Р51[р] = PS1[A] + PS1[C] 


3.4.2.23 PS MULSO multiply scalar high 
PSO[D] = PSO[A] + PSO[C] 
PS1[D] = PS1[A] + PSO[C] 


3.4.2.24 PS MULSI multiply scalar low 
PSO[D] = PSO[A] + PS1[C] 


Р51[р] = PS1[A] + Р51 [С] 


3.4.2.25 PS NMADD negative multiply-add 
PSO[D] = - (PSO[A] * PSO[C] + PSO[B]) 
Р51[р] = - (Р51[А] * PS1[C] + PS1[B]) 


3.4.2.26 PS NMSUB negative multiply-subtract 
PSO[D] = - (PSO[A] * PSO[C] - PSO[B]) 
PS1[D] = - (PS1[A] * PS1[C] - PS1[B]) 
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3.4.2.27 PS SEL select 
If (PSO[A] >= 0) then PSO[D] = PSO[C] else PSO[D] = PSO[B] 


If (РЅ1[А] >= 0) then PS1[D] = PS1[C] else PS1[D] = PS1[B] 


3.4.2.28 PS SUMO vector sum high 
PSO[D] = PSO[A] + PS1[B] 


Р51[р] = PS1[C] 


3.4.2.29 PS SUMI vector sum low 
PSO[D] = Р50 [С] 


PS1[D] = PSO[A] + PS1[B] 


3.4.3 Load and Store Instructions 


Mnemonic | Opcode Description 

psq 1x 000100 DDDDD AAAAA BBBBB WIII 000110 0 | Paired Singles Quantized Load indexed 

psq lux 000100 DDDDD AAAAA BBBBB WIII 100110 0 | Paired Singles Quantized Load with Update indexed 
psq stx 000100 SSSSS AAAAA BBBBB WIII 000111 0 | Paired Singles Quantized Store indexed 

psq stux 000100 SSSSS AAAAA BBBBB WIII 100111 0 | Paired Singles Quantized Store with Update indexed 
Mnemonic | Opcode Description 

psq 1 111000 DDDDD AAAAA WIII dddddddddddd | Paired Singles Quantized Load 

psq lu 111001 DDDDD AAAAA WIII dddddddddddd | Paired Singles Quantized Load with Update 

psq st 111100 SSSSS AAAAA WIII dddddddddddd | Paired Singles Quantized Store 

psq stu 111101 SSSSS AAAAA WIII dddddddddddd | Paired Singles Quantized Store with Update 


3.4.31 psq Іх Paired Singles Quantized Load indexed 


3.4.3.2 psq lux Paired Singles Quantized Load with Update indexed 


3.4.3.3 psq stx Paired Singles Quantized Store indexed 


3.4.3.4 psq stux Paired Singles Quantized Store with Update indexed 


3.4.3.5 рв4 1 Paired Singles Quantized Load 


3.4.3.6 psq lu Paired Singles Quantized Load with Update 


3.4.3.7 рв4 st Paired Singles Quantized Store 


3.4.3.8 psq stu  Paired Singles Quantized Store with Update 
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3.4.4 modified floating point instructions 


In paired single mode (HID2[PSE] = 1), all the double-precision floating point instructions are still valid, 
and execute as in non-paired single mode. АП single-precision floating-point instructions (fadds, fsubs, 
fmuls, fdivs, fmadds, fmsubs, fnmadds, fnmsubs, fres, frsp) switch their meaning and operate on the psO 
operand. 


Mnemonic | Opcode | Description 
fadds 
fsubs 
uls 
divs 
adds 
subs 
nmadds 
nmsubs 
res 

rsp 


НВ | h| h| ал Eh} Fh} Eh] Fh 


Hh 
n 
Ф 
Es 


fmr 


3.4.41 fadds 


3.4.4.2 fsubs 


3.4.4.3 fmuls 


3.4.4.4 fdivs 


3.4.4.5 fmadds 


3.4.4.6 fmsubs 


3.4.47 fnmadds 


3.4.4.8 fnmsubs 


3.4.4.9 fres 


3.4.4.10 frsp 


3.4.4.11 Бе 


3.4.4.12 fmr 
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3.5 Programming Tips and additional information 
3.5.1 Machine State Register 


to do 


3.5.2 Caches 


to do 


3.5.3 branch unit 


to flush branch unit’s dynamic prediction logic, you must sequentially execute 3 branches 


b labell 

labell: b label2 
label2: b label3 
label3: 
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4 Memory Map 


41 Overview 


start end size | description 
0x00000000 | 0х017ҒҒҒҒҒ | 24MB | Physical address of the RAM 
0x80000000 | 0x817fffff | 24MB | Logical address of the RAM, cached 
0xC0000000 | OxC17fffff | 24MB | Logical address of the RAM, not cached 
0xc8000000 2MB | Embedded Framebuffer (EFB) 
0xCC000000 Hardware registers 
0xCC000000 CP - Command Processor 
0xCC001000 PE - Pixel Engine 
0xCC002000 VI - Video Interface 
0xCC003000 PI - Processor Interface (Interrupt Interface) 
0xCC004000 MI - Memory Interface 
0xCC005000 AI - Audio Interface 
0xCC006000 DI - DVD Interface 
0xCC006400 SI - Serial Interface 
0xCC006800 EXI - External Interface 
0xCC006C00 Streaming Interface 
0xCC008000 GX FIFO (Graphic display lists) 
0xe0000000 | 0хе0003ҒҒҒ 16k | L2 Cache 
Oxfff00000 IMB | IPL (mapped here at bootup) 


4.0 RAM usage 


Variables that are marked as B are changed by bootrom or IPL. Variables marked as A are changed lately 
in apploader when a game is booting. Variables, which are marked as O are changed after an OSInit call. 
Remember that the IPL also has a hard-linked Dolphin OS inside, so those variables that are marked as O 
are also changed in the IPL. 


4.2.1 Dolphin-OS globals 


In PowerPC architectures the lower 256 bytes of main memory are reserved for internal OS use. This map 
describes all known OS low memory variables. Dolphin OS accesses low memory as 0x80000000 + offset 
(cached). 


4.2.1. Boot Info 


start size description 
0x80000000 | 0x04 | B | Gamecode 
0x80000004 | 0x02 | B | Company 
0x80000006 | 0x01 | B | Disk ID 
42..11 DVD Disc ID 0x80000007 | 0x01 | B Version 
0x80000008 | 0x01 | B | Streaming 


O audio streaming off 
] audio streaming on 
0x80000009 | 0x01 | B | StreamBufSize 
0x8000000a | 0х0Ё padding zeros 
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start size description 
0х8000001с А | DVD magic word 
0хс2339#3а | Nintendo Game Disc | 
0x80000020 4 A | Magic word (how did the console boot?) 
value description 
0x0D15EA5E | normal boot 
0хЕ5207С22 | booted from jtag 
0x80000024 4 A | Version (usually set to 1 by apploader) 
0x80000028 4 B | physical Memory Size 
0x01800000 | 24MB on retail console | 
0x8000002C 4 B | Console type 
value Description 
0x00000001 | Retaill 
0x00000002 | HW2 production board 
0x00000003 | The latest production board 
0x00000004 | Reserved 
4.2.1.1.2 system Info Ох1ххххххх | Devkits 
0x10000000 | MAC emulator 
0x10000001 | PC Emulator 
0x10000002 | "Arthur 
0x10000003 | 'Minnow' 
0x10000004 | Ist Devkit HW 
0x10000005 | 2nd Devkit HW 
0x10000006 | latest Devkit HW 
0x10000007 | Reserved 
0х2ХХХХХХХ | TDEV-kits 
0x20000005 | HW2 TDEV system 
0x20000006 | The latest ТРЕХ system 
0x20000007 | Reserved 
0x80000030 4 O | ArenaLo (==0x00000000) 
0x80000034 4 О | ArenaHi (==0х817е8с0) 
0x80000038 4 FST Location in ram (==0x817fe8c0) 
0x8000003C 4 FST Max Length (220x00000024) 
start size description 
0x80000040 4 A | flag for "debugger present" (used by. OSIsDebuggerPresent) 
. 0x80000044 4 A | Debugger Exception mask Bitmap, set to O at sdk lib start 
diode" sDebuggerinfo 0x80000048| 4 (А Ел кш ыо address) 
0x8000004c 4 A | Temp for LR, Return from exception address (to return from hook) 
0x80000050 | 16 padding zeros 
4.2.1.3 Debugger Hook .>80000060 38 a0 00 40 11 r5,0x40 r5=0x40 
.>80000064 7с 68 02 аб mflr r3 r3=lr 
.>80000068 90 65 00 0с stw r3,0x0c(r5) 
.>8000006с 80 65 00 08 lwz r3,0x08 (r5) 
.>80000070 64 63 80 00 oris r3,r3,0x8000 
.>80000074 7с 68 03 аб mtlr r3 lr-r3 
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.>80000078 
.>8000007с 
.>80000080 


38 60 00 30 
7с 60 01 24 
4e 80 00 20 


4.2.1.4 Dolphin OS Globals 
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li r3,0x30 
mtmsr r3 msr-0x30 
blr jump (lr) 


start end size description 
0x80000084 | 0x800000bf padding zeros 
0x800000c0 4 | O | Current OS context (physical address) 
0x800000C4 4 O | Previous OS interrupt mask 
0x800000C8 4 O | current OS interrupt mask 
0x800000CC TV Mode 
value | description 

0 ntsc 

1 pal 

2 debug 

3 debug pal 

4 mpal 

5 pal 60 
0x800000d0 В | ARAM size (internal+expansion) in bytes. set by ARAM driver, usually 16mb. 
0x800000D4 O | current OS Context (logical address) 
0x800000D8 O | default OS thread (logical address) 
0x800000Dc O | active Thread queue, head thread (logical address) 
0x800000e0 O | active Thread queue, tail thread (logical address) 
0x800000e4 O | Current OS thread 
0x800000e8 A | Debug monitor size (in bytes) 
0x800000ec A | Debug monitor location (usually at the top of main memory) 
0x800000F0 A | Console Simulated Memory Size, 0x01800000 (usually same as physical memor 
0x800000F4 А | DVD BD location in main memory (size of BI2 is 0x2000 bytes) 
0x800000F8 Bus Clock Speed, 162 MHz (=0x09a7ec80, 162000000) 
0x800000FC CPU Clock Speed, 486 MHz (=0x1cf7c580, 486000000) 

4.2.2 Exception Handlers 
start end size | description 

0x80000100 System Reset Interrupt 
0x80000200 Machine Check Interrupt 
0x80000300 DSI Interrupt 
0x80000400 ISI Interrupt 
0x80000500 External Interrupt 
0x80000600 Alignment Interrupt 
0x80000700 Program Interrupt 
0x80000800 FP unavailable Interrupt 
0x80000900 Decrementer Interrupt 
0x80000C00 System Call Interrupt 
0x80000d00 Trace Interrupt 
0x80000£00 Performance Monitor Interrupt 
0x80001300 IABR Interrupt 
0x80001400 reserved 
0x80001700 Thermal Interrupt 
0x80001800 | 0х80002ҒҒҒ unused/reserved (*) 
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(*) note: psoload v2 uses this area to stay resident in memory, it is unused by Dolphin-OS 


4.2.3 Dolphin-OS globals 


start end | size Description 
0x80003000 exception handler vectors (from sdk libs & ipl) 
0x8000303c 4 padding/unused 
0x80003040 external interrupt handler vectors (from sdk libs & ipl) 
0x800030a4 padding/unused 
0x800030c0 4 ? 
0х800030с4 4 9 
0х800030с8 4 First Module Header Pointer in Module Queue 
0x800030cc 4 Last Module Header Pointer in Module Queue 
0x800030d0 4 Module String Table Pointer 
0x800030d4 4 A | DOL size (total size of text/data sections), in bytes (*1) 
0x800030d8 4 B | OS system time (set, when console is powered up) 
0х800030ас 4 ? 
0x800030E0 4 ? (6=production pads ?) 
0x800030e4 2 ? 
0x800030e6 1 ? 
0x800030e7 1 ? 
0x800030e8 1 О | set by OsInit() (debugger stuff?) 
0x800030e9 1 O | set by OsInit() (debugger stuff?) 
0x800030ea 2 ? 
0x800030ec 4 ? 
0x800030F0 2 ? 
0x800030F2 1 Boot status 
value | description 
0 first boot 
1 already booted 
0x800030F3 1 ? 
0x800030F4 4 ? 
0x800030F8 4 ? 
0x800030Fc 4 ? 


(*1) If FST on DVD is placed after DOL, then BB2 FSTLength is added to this value. 


4.2.4 User Memory 


start 


end | size 


description 


Start of code (usually) 


| 
| 0х80003100 
| 


4.2.41 user program area 0x80003140 


Entry point (early SDK v1.0 applications) 


| 0х81200000 


Load Address of the Apploader 


| 0x81300000 


Load Address of Bootrom/IPL 


note: of course the entrypoint of an application can be anything, those listed here are just some typical 
examples. Retail game start dol-files are usually located below the apploader. 
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4.2.4.2 stack area 


4.2.4.3 heap area 


start | end | size | description 
Bottom of Stack 
Top of Stack 
start end | size description 
? O | ArenaLo - Bottom of Heap 
0x817fe8c0 O | ArenaHi - Top of Heap 
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note: the address of ArenaHi is not a constant, but should be set to the bottom of the FST which is read 


from the DVD so its size depends on the application. the value given here is just an example. 


4.2.4.4 "high memory’ 


start end | size description 
0х817Ее8с0 24 | О | FST (used by Dolphin-OS) 
0x817fffff Memory Top 
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5 Hardware Registers 


5.1 СР - Command Processor 


Registerblock Base | Size of Registerblock | common access size 
0хсс000000 0х80 2 


0xcc000000 | 2 | R/W | SR - Status Register 


bit(s) description 
5-15 unused/reserved 
4 BP (breakpoint?) interrupt 
3 GP is idle for commands (1: idle) 
2 GP is idle for reading (1: idle) 
1 gx fifo underflow (ptr<lo watermark) 
0 gx fifo overflow (ptr>hi watermark) 


0xcc000002 | 2 | R/W | СК - Control Register 


15 817 0 

b .mig 
bit(s) description 
6-15 unused/reserved 


5 b | bpenable 


1 | gp link enable (enable for linking of cp/pe FIFO) 


FIFO underflow irq enable (?) 


i | cp irq enable (?) (write 1 to clear bp irq?) 


4 
3 
2 m | FIFO overflow irq enable? / cp irq (clear to acknowledge) ? 
1 
0 


g | gp FIFO read enable 


0xcc000004 | 2 | W | Clear Register 


bit(s) description 

2-15 unused/reserved 
1 write 1 to clear FIFO underflow 
0 write 1 to clear FIFO overflow 


0xCC00000E | 2 | R/W | token register 


0xcc000010 | 2 | R/W | bounding box - left 


0xcc000012 | 2 | R/W | bounding box - right 


0xcc000014 | 2 | R/W | bounding box - top 


0xcc000016 | 2 | R/W | bounding box - bottom 
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0xCC000020 | 2 | ЕЛУ | cp FIFO base lo | 
0xCC000022 | 2 | R/W | cp FIFO base hi | 
0xcc000024 | 2 | R/W | cp FIFO end lo 
0xCC000026 | 2 | R/W | cp FIFO end hi 
0xCC000028 | 2 | R/W | cp FIFO high watermark lo 
0xcc00002a | 2 | R/W | cp FIFO high watermark hi 
0xCC00002c | 2 | R/W | cp FIFO low watermark lo 
0xcc00002e | 2 | R/W | cp FIFO low watermark hi 


the low and high watermark control the assertion of the CP interrupt 


0xCC000030 | 2 | R/W | cp FIFO read/write distance lo 
0xCC000032 | 2 | R/W | cp FIFO read/write distance hi 
0xCC000034 | 2 | R/W | cp FIFO write pointer lo 
0xCC000036 | 2 | R/W | cp FIFO write pointer hi 
0xCC000038 | 2 | R/W | cp FIFO read pointer lo 
0xcc00003a | 2 | R/W | cp FIFO read pointer hi 
0xCC00003c | 2 | R/W | cp FIFO bp lo 

0xcc00003e | 2 | R/W | cp FIFO bp hi 


5.1.1 Token register 


You can insert this dirty marker, at the end of command list, by this way : 


*(u32 *)GXFIFO = 0x4800XXXX 
*(u32 *)GXFIFO = 0x4700XXXX 
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Where XXXX is the token value. When command processor reaches this stage, it writes XXXX into 
PE token register (see above), and then raise "PE TOKEN" interrupt. Thus you can monitor the completion 


of your drawing tasks. 


note: its probably a good idea to send a BP 'drawing complete' command (0x45000002) before the in- 
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sertion of the token. 


5.2 PE - Pixel Engine 


bit(s) description 
4 Z update enable 
1-3 function 
0 z-comperator enable 


Registerblock Base | Size of Registerblock | common access size 
0хсс001000 0x100 2 
0xcc001000 | 2 | R/W | Zconfiguration 


0xcc001002 | 2 


R/W 


Alpha configuration 


15870 


bit(s) description 
12-15 blend operator (?) 
11 substractive / additive toggle (?) 
8-10 source 
5-7 destination 
4 alpha update enable 
3 color update enable 
2 dither enable (?) 
1 arithmetic blending enable (?) 
0 boolean blending enable (?) 
0xcc001004 | 2 | R/W | destination alpha 


bit(s) description 


8 enable 


0-7 alpha 


0xcc001006 | 2 


R/W 


Alpha Mode 


bit(s) description 


8-15 mode 


0-7 threshold 
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0xcc001008 | 2 | КЛУ | Alpha Read (?) 


15 0 
bit(s) description 
mode 
2 ? 


0xcc00100a | 2 | R/W | Interrupt Status Register 


15 0 

bit(s) description | 
3 PE Finish (set to acknowledge) | 
2 PE Token (set to acknowledge) | 
1 РЕ Finish enable (?) | 
0 РЕ Token enable (?) | 


0xcc00100e | 2 | ЕЛУ | PE Token ? 


15 87 0 

ttt. EEC. tttt. CEET 

bit(s) description 

0-15 PE Token (asserted from last PE Token Interrupt) 


5.3 VI- Video Interface 


Registerblock Base | Size of Registerblock | common access size 


0xcc002000 0x100 4 


0xcc002000 | 2 | R/W | VTR - Vertical Timing Register 


15 87 0 

008a аааа | aaaa ееее 

bit(s) description | 
4-13 ACV - Active Video (in full Lines) ? other source says Ва тез | 
0-3 EQU - Equalization pulse in half lines | 


pal50/pal60/ntsc: 0х11Е5, OxOF06, OxOF06 


The value in ACV is double buffered 
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0xcc002002 | 2 | R/W | DCR - Display Configuration Register 


15 8 [7 0 
0000 00рр | litt dire 


bit(s) description 


р | ЕМТ - Current Video Format 


NTSC 
PAL 

MPAL 
Debug 


Wl NN} = 


1 | LEI - Enables Display Latch 1 


0 | Off 

1 | On for 1 field 
2 | On for 2 fields 
3 | Always On 


t | LEO - Enables Display Latch 0 


0 | Off 

1 | On for 1 field 
2 | On for 2 fields 
3 | Always On 


d | DLR - Selects 3D Display Mode 


i | NIN - Interlace Selector 


О | Interlaced 


1 | Non-Interlaced, top field drawn at field rate and bottom field is not displayed 
г | RST - Reset - Clears all data requests and puts VI into its idle state. 


e | ENB - Enable - Enables video timing generation and data request. 


pal50/pal60/ntsc: 0x0101, 0х0001, 0х0001 


0xcc002004 | 4 | R/W | HTRO - Horizontal Timing 0 


31 24 | 23 16 | 15 817 0 
0555 5555 | беке ееее | 0000 000w | wwww wwww 


bit(s) description | 
$ | НС$ - Horizontal Sync Start to Color Burst Start | 


e | HCE - Horizontal Sync Start to Color Burst End 
HLW - Halfline Width (W*16 = Width (720)) 


pal50/pal60/ntsc: 0х4В6А01В0, 0x476901AD, 0x476901AD 


52 


5 HARDWARE REGISTERS 


0xcc002008 | 4 | R/W | НТВ! - Horizontal Timing 1 
31 24 | 23 16 | 15 8|7 0 
0000 0555 | 5555 ssse | eeee ееее | ewww wwww 
bit(s) description 
s | HBS - Half line to horizontal blanking start 
e | HBE- Horizontal Sync Start to horizontal blank end 
HSY - Horizontal Sync Width 


pal50/pal60/ntsc: 0x02F85640, 0x02EA5140, 0х02ЕА5140 


Setting bit 0 seems to blackout the screen. (Similar to ViBlack?) 


0xcc00200C | 4 | R/W | VTO - Odd Field Vertical Timing Register 
31 24 | 23 16 | 15 8 | 7 0 
..SS | 5555 5555 ЖЕ ||| ern ТЕГЕН 
bit(s) description 
16-25 | s | PSB - Post blanking in half lines | 
0-9 г | PRB - Pre-blanking in half lines | 


pal50/pal60/ntsc: 0x00010023, 0x00030018, 0x00030018 


53 


This register sets up the pre-blanking and post-blanking interval of odd fields, PRB and PSB are double-buffered. 


0xCC002010 | 4 | R/W | УТЕ - Even Field Vertical Timing Register 
31 24 | 23 16 | 15 8 | 7 0 
..SS | 5555 5555 woth rere” ree 
bit(s) description 
16-25 | s | PSB - post-blanking in halflines 
0-9 r | PRB - pre-blanking in halflines 


pal50/pal60/ntsc: 0x00000024, 0x00020019, 0x00020019 


This register sets up the pre-blanking and post-blanking intervals of even fields. PRB and PSB are double-buffered. 
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0xcc002014 | 4 | R/W | BBEI - Odd Field Burst Blanking Interval Register 
31 24|23 1611587 0 
bit(s) description 
21-31 BE3 - Field 3 start to burst blanking end in halflines 
16-20 BS3 - Field 3 start to burst blanking start in halflines 
5-15 ВЕ! - Field 1 start to burst blanking end in halflines 
0-4 BS1 - Field 1 start to burst blanking start in halflines 


pal50/pal60/ntsc: 0х4р2В4р6р, 0х410С410С, 0x410C410C 


0xcc002018 | 4 | R/W | BBOI - Even Field Burst Blanking Interval Register 
31 24|23 16/|15 8 7 0 
bit(s) description 
21-31 BEA - Field 4 start to burst blanking end in halflines 
16-20 BS4 - Field 4 start to burst blanking start in halflines 
5-15 BE2 - Field 2 start to burst blanking end in halflines 
0-4 BS2 - Field 2 start to burst blanking start in halflines 


pal50/pal60/ntsc: Ox4D8A4D4C, 0x40ED40ED, 0x40ED40ED 


O0xCC00201c | 4 | R/W | TFBL - Top Field Base Register (L) (External Framebuffer Half 1) 

31 24 | 23 16 | 15 8 [7 0 

ууу? 7727 | аааа аааа | аааа ааах | хххх хххх 

bit(s) description 

29-31 always zero (maybe some write only control register stuff?, setting bit 31 clears bits 31-28 (?)) 
28 page offset bit (*1) 

24-27 XOF - Horizontal Offset of the left-most pixel within the first word of the fetched picture. 
9-23 FBB - bit 23 - bit 9 of XFB Address (*2) 
0-8 unused (?) 


pal50/pal60/ntsc: 0x00435A4E, 0x00435A4E, 0x00435A4E 


This register specifies the display origin of the top field of a picture in 2D mode or for the left picture in 3D mode 


(*1) when this bit is set, the framebuffer address is calculated as (address> >5) 
(*2) if bit 28 is cleared, highest possible Address: Ox80fffe00 (set register to OxOOfffe00) (aligned to 9bit) 
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0xCC002020 


4 | R/W 


ТЕВК - Top Field Base Register (В) (Only valid in 3D Mode) 


31 24 


23 


16 | 15 8 | 7 


0 


0000 0000 


ffff 


ffff | ffff ҒҒҒО | 0000 0000 


bit(s) description 


f | FBB - External Memory Address of frame buffer 


pal50/pal60/ntsc: 0x00000000, 0x00000000, 0x00000000 


This register specifies the base address of the top field for the right picture in 3D mode. 


0xCC002024 | 4 | R/W | BFBL - Bottom Field Base Register (L) (External Framebuffer Half 2) 
31 24 | 23 16 | 15 8117 0 
YYYY уууу | aaaa аааа | аааа ааах | XXXX хххх 
bit(s) description 

y | always zero (maybe some write-only control register stuff?) 

28 page offset bit (*1) 
a | FBB - bit 23 - bit 9 of XFB Address 
unused (9) 


pal50/pal60/ntsc: 0x00435A4E, 0x00435A4E, 0x00435A4E 


This register specifies the display origin of the bottom field of a picture in 2D mode or for the left picture in 3D mode 


(*1) when this bit is set, the framebuffer address is calculated as (address> >5) 


0xCC002028 


4 | R/W 


BFBR - Bottom Field Base Register (В) (Only valid in 3D Mode) | 


31 24 


23 


16 | 15 8 | 7 


0 


0000 0000 


ffff 


ffff | ffff  fff0 | 0000 


0000 


bit(s) description 


f | FBB - External Memory Address of frame buffer 


pal50/pal60/ntsc: 0x00000000, 0x00000000, 0x00000000 


specifies the base address of the bottom field for the right picture in 3D mode. 


0xCC00202C 


2|R 


DPV - current vertical Position 


15 8 


7 


0 


0000 Ovvv 


VVVV 


VVVV 


bit(s) description 


v | VCT - current vertical Position of Raster beam 


pal50/pal60/ntsc: 0x013C, 0x0005, 0x0000 
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0xcC00202E | 2 | В | DPH- current horizontal Position (?) 
15 |7 0 
0000 Ohhh | hhhh hhhh 
bit(s) description 
h | HCT - current horizontal Position of Raster beam (?) 


pal50/pal60/ntsc: 0x0144, 0x0176, 0x0000 


The Horizontal Count is in pixels and runs from | to # pixels per line. It is reset to 1 at the beginning 


of every line. 


The Vertical Count is in lines (on a frame basis) and runs from | to # lines per frame. It is 1 at the beginning 
of pre-equalization. This is a frame line count. So for example: for NTSC vcount=264 is the first (full) 
line in the second field and vcount=525 is the last line in the frame (fields being numbered 1-4). For 
non-interlaced modes vcount is on a field-by-field basis (for NTSC vcount ranges from 1-263). 


This counting scheme applies the Display Position, Display Interrupt, and Display Latch registers. 


0xCC002030 | 4 | R/W | DIO - Display Interrupt 0 
31 24 | 23 16 | 15 8 | 7 0 
i00e 00чу | уууу vvvv | 0000 00ҺҺ | hhhh hhhh 
bit(s) description 
31 i | INT - Interrupt Status (1=Active) (Write to clear) 
28 e | ENB - Interrupt Enable Bit 
16-25 | v | VCT - Vertical Position 
0-9 h | HCT - Horizontal Position 


pal50/pal60/ntsc: 0x113901B1, 0x110701 AE, 0х110701АЕ 


There are a total of four display interrupt registers (0-3). They are used to generate interrupts to the 
main processor at different positions within a field. Each register has a separate enable bit. The interrupt is 


cleared by writing a zero to the status flag (INT). 


0xCC002034 


4 | R/W 


DII - Display Interrupt 1 


pal50/pal60/ntsc: 0x10010001, 0x10010001, 0x10010001 


Refer to Displ 


ay Interrupt 0 


0xCC002038 


4 | R/W 


DI2 - Display Interrupt 2 


pal50/pal60/ntsc: 0x00010001, 0x00010001, 0x00010001 


Refer to Displ 


ay Interrupt 0 
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0xcC00203C | 4 | R/W | DI3 - Display Interrupt 3 


pal50/pal60/ntsc: 0x00010001, 0x00010001, 0x00010001 


Refer to Display Interrupt 0 


0xCC002040 | 4 | R/W | DLO - Display Latch Register 0 
bit(s) Description 
31 TRG - Trigger Flag 
16-26 VCT - Vertical Count 
0-10 HCT - Horizontal Count 


pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 


The Display Latch Register 0 latches the value of the Display Position Register at the rising edge of the 20 
signal. The trigger flag is set if a gun trigger is detected. Writing a zero to the register clears the trigger flag. 


0xcc002044 | 4 | R/W | DLI - Display Latch Register 1 


pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 


See the description of Display Latch Register 0. This register is latched on the rising edge of the gtl 
signal. 


0xcc002048 | 2 | R/W | HSW - Scaling Width Register 


15 870 


bit(s) description | 
0-9 SRCWIDTH - Horizontal Stepping size | 


pal50/pal60/ntsc: 0x2850, 0х2850, 0x2850 


This register is the number of source pixels to be scaled. This is only used when the Horizontal Scaler 
is enabled. For example, if the image is to be scaled from 320x240 to 640x240, 320 would be written into 
this register. 


0xcc00204a | 2 | R/W | HSR - Horizontal Scaling Register 


15 8 | 7 0 
000е 000у | уууу vvvv 


bit(s) description 
12 e | HS_EN - Enable Horizontal Scaling 
0-8 у | STP - Horizontal stepping size (U1.8 Scaler Value) (0x160 Works for 320) 


pal50/pal60/ntsc: 0x0100, 0x0100, 0x0100 


This register sets up the step size of the horizontal stepper. 
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0xcc00204C | 4 | КЛУ | ЕСТО - Filter Coefficient Table 0 (AA stuff) | 


31 24123 16 15 8/7 0 


bit(s) description 

20-29 T2 - Tap2 

10-19 ТІ - Тар! 
0-9 TO - Тар0 


pal50/pal60/ntsc: 0x1 AE771F0, 0x1AE771F0, 0x1AE771F0 


sets up part of the low-pass filter. Taps 0 to 9 are in the range (0.0, 2.0) 


0хсс002050 | 4 | R/W | ЕСТІ - Filter Coefficient Table 1 (AA stuff) | 


31 24123 16 15 8/7 0 


bit(s) description 

20-29 T5 - Тар5 

10-19 T4 - Tap4 
0-9 T3 - Tap3 


pal50/pal60/ntsc: 0x0DB4A574, 0x0DB4A574, 0xODB4A574 


0хсс002054 | 4 | КЛУ | ЕСТ? - Filter Coefficient Table 2 (AA stuff) | 


31 24123 16115 8,7 0 


bit(s) description 

20-29 T8 - Tap8 

10-19 T7 - Tap7 
0-9 T6 - Tap6 


pal50/pal60/ntsc: 0х00С1188Е, 0x00C1188E, 0x00C1188E 


sets up part of the low-pass filter 
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0xcc002058 | 4 | R/W 


FCT3 - Filter Coefficient Table 3 (AA stuff) | 


31 24 |23 16 15 8 7 0 
bit(s) description | 
24-31 T12 - Tap12 | 
16-23 ТИ - Тар11 | 
8-15 | | Т10-Тар10 | 
0-7 Т9-Тар9 | 


pal50/pal60/ntsc: OxC4COCBE2, OxCACOCBE2, OxCACOCBE2 


sets up part of the low-pass filter. Taps 9 to tap 24 are in the Rage (-0.125, 0.125) 


FCT4 - Filter Coefficient Table 4 (AA stuff) | 


0xcc00205c | 4 | R/W 
31..-24.|:28. 16 | 15. 8 "Lk ^0 
bit(s) description | 
24-31 T16 - Тар16 | 
16-23 | | TI5- Tapl5 | 
8-15 T14- Тар14 | 
0-7 | | TI3- Tapl3 | 


pal50/pal60/ntsc: OxFCECDECF, 0xFCECDECF, 0xFCECDECF 


ЕСТ5 - Filter Coefficient Table 5 (AA stuff) | 


0xcc002060 | 4 | ЕЛУ 
З 524 |2235 26 '"15- 48-72-70 
bit(s) description | 
24-31 T20 - Tap20 | 
16-23 | | Т19-Тар19 | 
8-15 Т18 - Тар18 | 
0-7 ТІ7- Tap!7 | 


pal50/pal60/ntsc: 0x13130F08, 0x13130F08, 0x13130F08 
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0хсс002064 | 4 | КЛУ | ЕСТЬ - Filter Coefficient Table 6 (AA stuff) | 


31 24123 16 1587 O 


bit(s) description 
24-31 T24 - Hardwired to zero 
16-23 T23 - Tap23 
8-15 T22 - Tap22 
0-7 T21 - Tap21 


pal50/pal60/ntsc: 0х00080СОЕ, 0х00080СОЕ, Ox00080COF 


sets up part of the low-pass filter 


0xcc002068 | 4 | R/W | ? (AA stuff) | 


pal50/pal60/ntsc: 0х00ЕЕ0000, 0x00FF0000, OxO0FF0000 


0xCC00206C | 2 | R/W | VICLK - VI Clock Select Register 


15 87 0 
0000 0000 | 0000 000s 


bit(s) description 
| 0 | 27 MHz video CLK | 
| 1 54 MHz video CLK (used in Progressive Mode) | 


т 


pal50/pal60/ntsc: 0x0000, 0х0000, 0х0000 


0xcc00206e | 2 | R/W | VISEL - VI DTV Status Register 


15. 819. 20 


bit(s) description 
2 VISEL - don’t care 


pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 


this register allows software to read the status of two i/o pins 


0xcc002070 | 2 | R/W ІЙ 


Holds 0х280, but has no effect on change (maybe for Progressive ?) 


pal50/pal60/ntsc: 0x0280, 0x0280, 0x0280 
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0xcC002072 | 2 | r/w | HBE - Border HBE 


Т9" 28 |) У. 20 


bit(s) description | 
15 BRDR_EN - Border Enable 
0-9 HBE656 - Border Horizontal Blank End | 


pal50/pal60/ntsc: 0x0000, 0x0000, 0х0000 


This register (in conjunction with the border HBS) sets up a black border around the actual active pix- 
els in debug mode. This was done in order to accommodate certain encoders that only support 720 active 
pixels. The border HBE and HBS can be programmed for 720 active pixels while the regular HBE and 
HBS can be programmed to the actual active width. This allows the frame buffer to be of any width with- 
out having to manually set up a border in memory. These registers will only take effect if enabled and in 
debug mode. 


0хсс002074 | 2 | r/w | HBS - Border HBS 


15870 


bit(s) description 
0-9 HBS656 - Border Horizontal Blank start 


pal50/pal60/ntsc: 0x0000, 0x0000, 0x0000 


0хсс002076 | 2 | ?/? | ? (unused?) 


pal50/pal60/ntsc: OxXOOFF, OxOOFF, OxOOFF 


0xcc002078 | 4 | ?/? | ? (unused?) 


pal50/pal60/ntsc: OxOOFFOOFF, OxOOFFOOFF, OxOOFFOOFF 


0xcc00207c | 4 | ?/? | ? (unused?) 


pal50/pal60/ntsc: OxOOFFOOFF OxOOFFOOFF, 0xOOFFOOFF 


5.3.1 Video Modes 


Mode TV Norm / Region | Framerate | Columns | Lines 
NTSC ntsc (usa, japan) 60Hz 640 480 
PAL pal (europe) 50Hz 640 574 
DEBUG 
DEBUG PAL 
MPAL pal (brazil) 60Hz 640 480 
PAL60 pal 60Hz 640 480 


note: other modes may be possible using VGA output, although its unlikely. 
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5.4 PI- Processor Interface 


Registerblock Base | Size of Registerblock | common access size 
0xcc003000 0x100 4 
0хСС003000 | 4 | r | INTSR - interrupt cause | 
31 24 | 23 16 | 15 8 [7 0 
4 
bit Description 
17-31 unused/reserved 
16 г | RSWST Reset Switch State (1 when pressed) 
14-15 unused/reserved 
13 HSP High Speed Port 
12 DEBUG External Debugger 
11 CP Command FIFO 
10 PE FINISH | Frame is Ready 
9 PE TOKEN | Token Assertion in Command List 
8 VI Video Interface 
7 MEM Memory Interface 
6 DSP DSP 
5 АТ Streaming 
4 EXI ЕХІ 
3 SI Serial 
2 DI DVD 
1 RSW Reset Switch 
0 ERROR GP runtime error 
0xCC003004 | 4 | r/w | INTMR - interrupt mask 
31 24 | 23 16 | 15 8 17 0 
bit Description 
13 HSP High Speed Port 
12 DEBUG External Debugger 
11 CP Command FIFO 
10 PE FINISH | Frame is Ready 
9 PE TOKEN | Token Assertion in Command List 
8 VI Video Interface 
7 MEM Memory Interface 
6 DSP DSP 
5 АТ Streaming 
4 EXI EXI 
3 SI Serial 
2 DI DVD 
1 RSW Reset Switch 
0 ERROR GP runtime error 
0xCC00300c | 4 | r/w | FIFO Base Start 
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0xcc003010 | 4 | ?/? | FIFO Base End? 


0xcc003014 | 4 | ?/? | PI (cpu) FIFO current Write Pointer? 


0xcc003018 [4 | W |? | 


0хсс00301с [4 | W |? | 


0xcc003020 | 4 | 2/2 | ? | 


0xcc003024 | 4 | ?/? | Reset? 


Writing anything here seems to cause a complete reset. 


0xCC00302c [4 | ?2 |? | 


31 24 | 23 16. 15 8 | 7 0 


bit(s) Description 
28-31 console type (2: hw2) 


5.4.1 Operation 


5.4.1.1 FIFO/Write Gather Pipe when CPU writes а byte to 0хсс008000, it is written to mem[writeptr], 
and writeptr is increased automatically. 


Охсс008000 is the write gather pipe, a way for the CPU to blast sequences of things of various sizes to 
memory without having to keep track of the write pointer and wrapping manually. the gp then reads what 
the CPU has written to memory. It is used for Display Lists. it will disconnect the GP from the write- 
gatherpipe (сс000002 & 0x10 = 0), and change the write ptr to where it wants to write a display list.. then 
use ordinary GX commands to build it. there's a Call Displaylist GX command.. so it will store render 
commands for rendering a certain object (for example) in a display list in memory, then send ће CallDL 
with the address to the list instead of sending all the vertices over the FIFO. 


5.4.1.2 Interrupts Each interrupt has one or more "source" devices. It means that some kind of device 
may generate a couple of different interrupts, represented by a single bit in interrupt registers. To "enable" 
interrupt, set bit in mask register. To ignore all interrupts write 0 to interrupt mask register. Raising of any 
interrupt will set corresponding bit in interrupt cause register. Interrupt cause register resets to 0, when read 
(i.e. you must read it to clear pending interrupts). 


Interrupt mask register isn't controlled by hardware logic. Note that masking of interrupt in INTMR 


doesn't disable it at all. It is only causing masked interrupt to be ignored in the software interrupt han- 
dler. You must clear corresponding "source" device registers, to completely disable interrupt. 


5.4.1.3 hotreset this code snippet will reset the machine almost as if powered off/on 
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lis r3,0 

lis r9,0xCC00 

sth r3, 0x2000 (r9) 
li r4, 3 

stw r4, 0x3024(r9) 
stw r3, 0x3024(r9) 
nop 

loop : 

b loop . 


5.5 MI - Memory Interface 
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Protection can be enabled only for pages (page size is 1024 bytes), and you can specify only 4 protected 
regions of memory. External interrupt will be raised, if CPU try to wrong access in protected region. Be- 
cause it's allowed to enable protection for 4 regions only, there are a total of 4 possible interrupts which are 
called MEM 0, MEM 1, MEM 2 and MEM 3. 


Registerblock Base | Size of Registerblock 


common access size 


0xcc004000 0x80 4 
0xCC004000 | 4 | r/w | Protected Region Nol 
0xCC004004 | 4 | r/w | Protected Region No2 
0xCC004008 | 4 | r/w | Protected Region No3 
0xCC00400c | 4 | r/w | Protected Region No4 
31 24 | 23 16 | 15 8 | 7 0 


1111 1111 | 1111 


1111 | hhhh hhhh | hhhh  hhhh 


bit(s) Description 


16-31 | 1 | Page Address Lo 


0-15 | h | Page Address Hi 


note: the page address can be calculated as 


(physical_address>>10) 


0xCC004010 | 2 | гу 


type of the protection, 4*2 bits 


15 817 0 
3322 1100 

bit(s) Description 
unused/reserved 


6 3 | Channel 3 


0 | access denied 


1 | read only (break on write) 


2 | write only (break on read) 


3 | read / write (no protection, full access) 
4 2 | Channel 2 (see Channel 3) 


N 
— 


Channel 1 (see Channel 3) 


0 O | Channel 0 (see Channel 3) 
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0xCC00401c | 2 | ?/w | MI interrupt mask 


15 8: 0 
..m 3210 
bit(s) Description 
4 m | mask all MI interrupts (1 - enable) 
3 3 | mask MEMG interrupt (1 - enable) 
2 2 | mask МЕМ2 interrupt (1 - enable) 
1 1 | mask MEM I interrupt (1 - enable) 
0 0 | mask MEMO interrupt (1 - enable) 


0xCC00401e | 2 | r/w interrupt cause | 


15 817 0 
..m 3210 


bit(s) Description 

4 m | all MI interrupts 

3 3 | МЕМЗ interrupt 
read |0 | irq has not been requested 
1 | irq has been requested 
write | 0 | no effect 
1 | clear pending irq assertion 
2 2 | МЕМ2 interrupt 
read | 0 | irq has not been requested 
1 | irq has been requested 
write | 0 | no effect 
1 | clear pending irq assertion 
1 1 | MEMI interrupt 
read | 0 | irq has not been requested 
1 | irq has been requested 
write | 0 | no effect 
1 | clear pending irq assertion 
0 0 | MEMO interrupt 
read | 0 | irq has not been requested 

1 | irq has been requested 
write | 0 | no effect 
1 | clear pending irq assertion 


0xcc004020 | 2 | 2/? 2 | 


15 8 17 0 
..m. 
bit(s) Description 
1 1 | ? (set when MI interrupt has been asserted) 
0 0 |? 


note: assume to be zero, after init, and should be cleared by interrupt handler. 
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0xCC004022 | 2 | г/? | ADDRLO - address which failed protection rules 
15 8e 0 
bit(s) Description 
5-15 bit 5-bit 15 of address 
0-4 Zero 
0xcc004024 | 2 | r/? | ADDRHI - address, which failed protection rules 
15 8|7 0 
bit(s) Description 
14-15 Zero 
0-13 bit 16-bit 29 of address 
0xCC004032 | 2 | r/? | TIMERHI 
0xcc004034 | 2 | r/? | TIMERLO 
0xCC004036 | 2 | r/? | TIMERHI 
0xcc004038 | 2 | 1/? | TIMERLO 
0xcc00403a | | r/? | TIMERHI 
0xcc00403c | 2 | 1/? | TIMERLO 
0xcc00403e | 2 | r/? | TIMERHI 
0xcc004040 | 2 | 1/? | TIMERLO 
0xCC004042 | 2 | r/? | TIMERHI 
0xcc004044 | 2 | r/? | TIMERLO 
0xcc004046 | | r/? | TIMERHI 
0xcc004048 | 2 | r/? | TIMERLO 
0xcc00404a | 2 | r/? | TIMERHI 
0xCC00404c | 2 | 1/? | TIMERLO 
0xcc00404e | 2 | r/? | TIMERHI 
0xCC004050 | 2 | 1/? | TIMERLO 
0xCC004052 | 2 | r/? | TIMERHI 
0xcc004054 | 2 | 1/? | TIMERLO 
0xCC004056 | 2 | r/? | TIMERHI 
0xcc004058 | 2 | 1/? | TIMERLO 
note: writing anything to the timer register resets it to zero 

0xcc00405a | 2 | 1? |? 
15 8|7 0 

XXX XXXX XXXX 


bit(s) 


Description 


11-15 


unused ? 
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5.6 DSP - Digital Signal Processor Interface 


At the heart of the GCN audio hardware is a custom digital signal processor (DSP) which is largely ded- 
icated to pitch modulation and the mixing of voices and effects data. The DSP is augmented by a large 
quantity of auxiliary RAM (ARAM) which may be used to store audio samples. The GCN audio hardware 


features a custom digital signal processor (DSP) which has the following characteristics: 


81MHz instruction clock. 

16-bit data words and addressing. 

8KB (4Kword) Data RAM. 

4KB (2Kword) Data ROM. 

8KB (4Kword) Instruction RAM. 

8KB (4Kword) Instruction ROM. 
40-bit add-and-multiply-result registers. 
Hardware ADPCM decoder. 

Cached memory interface to ARAM. 
DMA interface to main memory. 


"Mailbox" registers for communicating with the CPU. 


Register block Base | Size of Register block | common access size 
0xCC005000 0x200 bytes 16bit words 

0xcC005000 | 2 | r/w | DSP Mailbox High (to DSP) 

0xCC005002 | 2 | г/м | DSP Mailbox Low (to DSP) 


bit31 of DSP Mailbox shows mail delivery status. (it will be cleared when the transfer is done) 
to send mail just write data, high word first, with bit31 set. 


0xCC005004 
0xCC005006 


2 
2 


ala 


CPU Mailbox High (from DSP) 
CPU Mailbox Low (from DSP) 


6131 of CPU Mailbox shows mail delivery status. 
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0xcC00500a | 2 | ?/w | AI DSP CSR - Control Status Register (DSP Status) 
15 8 | 7 0 
bit(s) Description 
11 Reset DSP (?) 
10 
9 DSP DMA Int Status 
8 DSPINTMSK - DSP interrupt mask (*1) 
7 DSPINT 
read | 0 | no interrupts 
1 | interrupt is active 
write | 0 | no effect 
1 | clear interrupt 
6 ARINTMSK - ARAM interupt mask (*2) 
5 ARINT - 
read | 0 | no interrupts 
1 | interrupt is active 
write | 0 | no effect 
1 | clear interupt 
4 AIDINTMASK - АГ interrupt mask (*3) 
3 AIDINT 
read | 0 | no interrupts 
1 | interrupt is active 
write | 0 | no effect 
1 | clear interrupt 
2 HALT - Halt DSP (?) 
read | 0 
1 
write | 0 | unhalt DSP 
1 | halt DSP (stop task execution) 
1 PIINT - DSP Interrupt Assertion (?) 
read | 0 
1 
write | 0 
1 | assert PI DSP interrupt 
0 RES - Reset DSP (?) 
read | 0 
1 
write | 0 
1 | reset DSP 


(*1) disables only PI interrupt, doesnt effect assertion of DSPINT. 
(*2) disables only PI interrupt, doesnt effect assertion of ARINT. 
(*3) disables only PI interrupt, doesnt effect assertion of AIDINT. 


0xCC005012 


2 


of? 


AR SIZE 
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0xcc005016 | 2 | ?/? | AR MODE 

0xcc00501a | 2 | ?/? | AR. REFRESH 
0xcc005020 | 2 | 2/2? | АК DMA MMADDR н 
0xcc005022 | 2 | ?? | AR ОМА MMADDR L 
0xcc005024 | 2 | ?? | AR РМА ARADDR Н 
0xcc005026 | 2 | ?? | AR РМА ARADDR 1 | 
0xcc005028 | 2 | ?? | АК РМА СМТ Н 


bit(s) description 


15 type of transfer (0: write to агат 1: read from aram) 


0-14 high bits of transfer length 


0xCC00502a 


2 


of? 


AR DMA СМТ L 


0xCC005030 


2 


?/w 


DMA Start address (High) 


Start of Audio Data 


0xCC005032 


2 


hw 


DMA Start address (Low) 


Start of Audio Data 


0xCC005036 


?/w 


DMA Control/DMA length (Length of Audio Data) 


15 8 | 7 


0 


аххх хххх 


XXXX 


XXXX 


bit(s) 


Description 


0-віор sample 1=рІау sample 


length/32 (max len is 0x000fffe0) 
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0xCC00503a | 2 | r/? | DMA Bytes left 


Counts down to zero showing how any bytes are left 


5.6.1 internal DSP Registers 


Registerblock Base | Size of Registerblock | common access size 
Oxffc9 2 


OxFFC9 | 2 | r/w | DSCR - DSP dma Control Register 


bit(s) description 


3-15 unused/reserved 
2 DSP DMA busy 
read | 0 


1 | Block length counter not yet zero, DMA is still busy 
write | O | no effect? 

1 | no effect ? 

1 DSP source/destination (DMA involved DSP memory) 

0 | DSP data memory | 

1 | DSP instruction memory | 
0 transfer direction 

0 | from main memory to DSP memory 
1 | from DSP memory to main memory 


OxFFCB | 2 | r/w | DSBL - DSp dma Block Length 


15. “8127.40 


bit(s) description 
2-15 block length - This register is used to specify DSP DMA transfer length from bit 15 to bit 2 
0-1 r: 2 bit of its LSBs - The transfer length is a multiple of 4 bytes 


OxFFCD | 2 | r/w | DSPA - DSp dma dsP memory Address High 


bit(s) description 
1-15 DSP memory address - This register is used to specify DSP memory starting/current address from bit 15 to bit 1 
0 г: 1 bit of its LSBs - The DSP memory address should be located at 2 word boundary 


5 HARDWARE REGISTERS 71 


OxFFCE | 2 | r/w | DSMAH - DSp dma Main memory Address High 


15» 581075240 


bit(s) description 
10-15 r: 6 bits of its MSBs - This register is used to specify DSP DMA main memory starting/current address from bit 
0-9 main memory address high word - This register is used to specify DSP DMA main memory starting/current add: 


OxFFCF | 2 | r/w | DSMAL - DSp dma Main memory Address Low | 


15 870 


bit(s) description 
2-15 main memory address - This register is used to specify DSP DMA main memory starting/current address from b 
0-1 r: 2 bits of its LSBs - The main memory address of this DMA should be located at 4 byte boundary 


OxFFD4 | 2 | r/w | ACSAH - Accelerator aram Starting Address High | 


15 8 |7 0 
bit(s) description 
11-15 unused/reserved 


0-10 wtarting address high-word - Bit 26 to bit 16 of ARAM starting address 


OxFFD5 | 2 | r/w | ACSAL - Accelerator aram Starting Address Low 


ES: e Gle R “0 


bit(s) description 
0-15 Starting address low-word - Bit 15 to bit 0 of ARAM starting address 


OxFFD6 | 2 | w | ACEAH - Accelerator aram Ending Address High 


15 8/7 0 
bit(s) description 
15-11 unused/reserved 


0-10 ending address high-word - Bit 26 to bit 16 of ARAM ending address 
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OxFFD7 | 2 | w | ACEAL - Accelerator aram Ending Address Low 
15 8/7 0 
bit(s) description 
0-15 ending address low-word - Bit 15 to bit 0 of ARAM ending address 
OxFFD8 | 2 | r/w | ACCAH - Accelerator aram Current Address High 
15 8/7 0 
bit(s) description 
15 direction 
| 0 | accelerator read ARAM | 
| 1 | accelerator write ARAM | 
11-14 unused/reserved 
0-10 current address high-word - Bit 26 to bit 16 of ARAM current address 
OxFFD9 | 2 | т/м | ACCAL - Accelerator aram Current Address Low 
15 8/7 0 
bit(s) description 
0-15 Bit 15 to Bit 0 of ARAM current address 
OxFFEF | 2 | т^у | AMDM - ARAM-Dma request Mask 
15. 2784 [Е 0 
bit(s) description | 
1-15 unused/reserved | 
0 | 0 | DMA request ARAM is unmasked | 
| 1 | DMA request ARAM is masked | 


5.6.2 Operation 


5.6.2.1 play raw audio sample 


[> load DMA Start Address 


> setup DMA Control/DMA length 


5.6.2.2 transfer from/to ARAM 


[> set main memory address in АК DMA MMADDR Н and АК DMA MMADDR Г, 
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> set aram address in АВ DMA, ARADDR Н and АВ DMA ARADDR L 
[> set length and transfer type in АК РМА СМТ Н and АК РМА CNT L 


> wait until bit 9 of AI DSP Control register gets cleared 


5.6.2.3 reset DSP 


> set bitO and bit11 of AI DSP Control Register 


5.6.2.4 Boot DSP Task 


send mail to DSP: 0x80F3A001, гат mmem, addr 
send mail to DSP: 0x80F3C002, ram, addr 
send mail to DSP: 0x80F3A002, ram length 


send mail to DSP: 0x80F38002, aram mmem адаг (7-0 2) 


send mail to DSP: 0x80F3D001, dsp. init vector 


5.7 DI- DVD Interface 


Register block Base | Size of Register block | common access size 
0xCC006000 0x40 4 
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0xCC006000 | 4 | r/w | DISR - DI Status Register 


31 24 | 23 16 | 15 8 | 7 0 


bit(s) description 
7-31 reserved 

6 BRKINT - Break Complete Interrupt Status (*1) 
read | 0 | Interrupt has not been requested 
1 | Interrupt has been requested 
write | 0 | no effect 
1 | clear Interrupt 
BRKINTMASK - Break Complete Interrupt Mask. 0:masked, 1:enabled (*2) 
4 TCINT - Transfer Complete Interrupt Status (*3) 
read | 0 | Interrupt has not been requested 
1 | Interrupt has been requested 
write | 0 | no effect 
1 | clear Interrupt 
3 TCINTMASK - Transfer Complete Interrupt Mask. 0:masked, 1:enabled (*4) 
2 DEINT - Device Error Interrupt Status (*5) 
read | 0 | Interrupt has not been requested 
1 | Interrupt has been requested 
write | 0 | no effect 
1 | clear Interrupt 
1 DEINTMASK - Device Error Interrupt Mask. 0:masked, 1:enabled (*6) 
BRK - DI Break (*7) 


сл 


read | 0 | break not requested or break complete | 
1 | break requested and pending | 
write | 0 | no effect | 
1 | request break | 


(*1) On read this bit indicates the current status of the break complete interrupt. This interrupt is as- 
serted when a Break cycle has completed (break acknowledge received from mass storage access device). 
When a 41515 written to this register, the interrupt is cleared. 

(*2) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the 
assertion of DISR[BRKINT] 

(*3) On read this bit indicates the current status of the transfer complete interrupt. The Transfer Complete 
interrupt is asserted under the following conditions: a DMA mode transfer has completed (DMA finished) 
or an Immediate mode transfer has completed (transfer to/from DIIMMBUF has completed). When a 41516 
written to this register, the interrupt is cleared. The assertion of TCIT is delayed until the DIDSTRBb (low) 
in order to guarantee the error interrupt occurs before transfer complete interrupt. If DIERRb is asserted 
during the current transaction, the transaction will be halted and TCINT will not be asserted. 

(*4) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the 
assertion of DISR[TCINT] 

(*5) On read this bit indicates the current status of the mass storage access device error interrupt. To clear 
this interrupt, two actions must occur. When a *1* is written to this register, the internal interrupt is cleared. 
To reset the DIERRb signal, a command must be issued to the external DI device. If error occurs during the 
command packet, the drive has to delay the error assertion until the completion of the 12 bytes command 
transfer. In immediate mode, if error occurs during the data packet, the error assertion has to be delayed 
until the completion of the 4 bytes data transfer. In DMA mode, it has to be delayed until the completion 
of any 32 bytes data transfer. 

(*6) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the 
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assertion of DISR[DEINT] 


(*7) When a '1* is written to this bit, the DI controller interrupts the current command and sends a break 
signal to the mass storage access device. The break signal interrupts the current command on the mass 
storage access device. After the break sequence is complete (see TCINT), a new command may be sent 
to the mass storage access device. This bit is cleared after the break command is complete. Note that DI 
controller will delay the break signal assertion if it is in the middle of the command transfer. Hence break 


can only occur during the data transfer or when it is idle. 


0xCC006004 | 4 | r/w | DICVR - DI Cover Register (status2) 
31 24 | 23 16 | 15 8 |7 0 
. smc 
bit(s) Description 
2 s | CVRINT - Cover Interrupt Status (*1) 
read | 0 | cover interrupt has not been requested 
1 | cover interrupt has been requested 
write | 0 | no effect 
1 | clear cover interrupt 
1 m | CVRINTMASK - Cover Interrupt Mask. 0: masked, 1: enabled (*2) 
0 c | CVR - State of the DICOVER signal. 0: cover closed, 1: cover opened 


(*1) On read this bit indicates the current status of the Mass Storage Device Cover interrupt. When a 
41516 written to this register, the internal interrupt is cleared. The Mass Storage Device Cover Interrupt is 
asserted when the status of the DICOVER signal changes (e.g., when the cover is opened or closed). 

(*2) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the 


assertion of DISR[CVRINT]. 


0xCC006008 | 4 | г/м | DICMDBUFO - DI Command Buffer 0 
31. 24 | 23 16 | 15 817 0 
ccec cocco | 1111. ТЕ | 2222 —22224| 2222 12222 
bit(s) Description | 
24-31 | c | command | 
16-23 | 1 | subcommand 1 | 
0-15 |2 | subcommand 2 | 
0xcC00600c | 4 | r/w | DICMDBUFI - DI Command Buffer 1 (offset in 32 bit words) 
0xCC006010 | 4 | r/w | DICMDBUF2 - DI Command Buffer 2 (source length) | 
0xCC006014 | 4 | r/w | DIMAR - DMA Memory Address Register 
31 24 | 23 16 | 15 817 0 
bit(s) description 
26-31 reserved/unused 
5-25 DIMAR - Address of source/destination buffer in main Memory 
0-4 always zero (Address must be 32 byte aligned) 


HARDWARE REGISTERS 76 


0xCC006018 | 4 | r/w | DILENGTH - DI DMA Transfer Length Register 
31 24 | 23 16 | 15 ВЯ 0 
bit(s) description | 
26-31 reserved/unused | 

5-25 DILENGTH - length of DMA data transfer in bytes (*1) | 

0-4 always zero (transfer length must be 32 byte aligned) | 


(*1) If a DMA command is interrupted by a break cycle, this register indicates the amount of data that 
was left to transfer before the DMA command was interrupted. If the length equals zero, it is a special case 
with command transfer only. 


0xcc00601c | 4 | r/w | DICR - DI Control Register 
31 24 | 23 16 | 15 8 | 7 0 
.mbe 
bit(s) Description 
2 m | RW - access mode, O:read, 1:write 
1 b | DMA - 0: immediate mode, 1: DMA mode (*1) 
0 e | TSTART - transfer start. write 1: start transfer, read 1: transfer pending (*2) 


(*1) The only mass storage device packet command which can use immediate mode is the ‘Register Ac- 
cess‘ command. When in immediate mode, the DIMAR and DILENGTH registers are ignored. 


(*2) When read this bit represents the current command status. This bit is also cleared after the break 
completion and after DIERRb is asserted. 


0xCC006020 | 4 | г/м | DIIMMBUF - DI immediate data buffer (error code ?) | 
31 24 | 23 16 | 15 Sun 0 
bit(s) description 
24-31 REGVALO - data of register address+0 
16-23 REGVALI - data of register address+1 
8-15 REGVAL2 - data of register address+2 
0-7 REGVAL3 - data of register address+3 
0xcCc006024 | 4 | т | DICFG - DI Configuration Register | 
31 24 | 23 16 | 15 8 |7 0 
bit(s) description 
8-31 reserved/unused 
0-7 CONFIG - during reset this register latches DIDD bus (only bit 0 used) 
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5.71 Drive Commands 


e[qeuo orpny ала | (peor) шит - = = E = 000010v9X0 
e[qesip orpny ала | (pees) шип - З = к Е 00000079Х0 
лоор 4046 | (peor) шип - = = т = 000000£9X0 

133$ orpny 15эпБэл peo шишт (0) 801826 2291 - - т E 00002229Х0 
(¿) ureong orpny Ава peor шит - - - | gs3uo'T-urang | << <чош1$од-шюәд$ 000022 T2x0 
$1116 10119 ysonbar pear шип | 9pod-IOMA дәт - = E Е 00000009Х0 
yoos | (рвәл) шип - - = E T< «uonisoq 0000004%Х0 

б б б б б б ГА 02000089X0 

б б б б б б [А 08000082х0 

SALT WUT/CI эта PLA | peor VWA - | 0с000000х0 ЯГА 391 0с000000х0 00000000х0 0v000089X0 
1029$ реэл | peor УМА - | шзиәт-ева | 918 01-101296 дә 41842] -е3за T< «uonisoq-ejeq 0000008=х0 

Aumbuy | peor ууа - | 020000000 ogu[-oAn(T 2291 0с000000х0 00000000х0 000000сТтх0 

uondrisoq чо Aag NINIIG | HLONATIG чупа | CANAGWOIG маяалота | 0408G0INDIG 
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5.7.2 Drive Debug Commands 


WLHS IVI. I Хой (peor) шап Ж Š 2 3ў601ўў6Х0 67375474х0 Т?Ы?1011Х0 
AINVD-GAG. с AON | (peor) шит - a = 005057р7х0 TPLEPZPPXO 96770055Х0 
ounj, ssarppe oy sf | (peor) wut : - Е с999с/199х0 | өөәірре NAPT 00002193X0 
*X»euo-osip op | (peor) шип - - z а - | (x) 0008ТТӘ2Х0 

Adoo 34эээв | (peor) шш - Б : - - | (ж) 000v1193X0 

әлі1р 31035 | (peor) шип - 3 - z - | (+) 0010119JX0 

әлир 403$ | (peor) шип - Б z а - | (x) 0000TTEIX0 

$ | (peor шит А т т ГА ГА 00000193X0 

IJI JIM | (QUM) шип әп[ел 71406 = я 00000033X0 JOSJJO 00181093X0 

IJI peor | (peor) шип | on[eA 11476 291 - è 00000033X0 39530 00081093X0 

IJI QIM | (QM) шип әп[ел 7076 - = 00001000X0 79530 00101093X0 

AJOWOU реэл | (peor) шип | en[eA VAZE 291 2 - 00001000X0 79530 00001093X0 

ó é РА b " " 6 &£6660093X0 

uondrsaq чо AOSININIId | HLONATIC | чупа | CHNAGWOId | TANAGWOId ояаяналота 


(*) commands сап be ORed to perform several actions at once 
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5.7.3 Operation 


5.7.3.1 Drive Info (Inquiry) 


start end size | Description 
0x0000 | 0x0001 | 0x02 | revision level 
5.7.3.1.1 Structure of the Drive Info Data 0x0002 | 0x0003 | 0x02 | device code 
0x0004 | 0x0007 | 0x04 | release date 
0х0008 | 0х001Е | 0x18 | padding zeros 


5.7.3.2 Read Disc ID / Init Disc 


5.7.3.3 Read Sector 


5.7.3.4 Seek 


5.7.3.5 Request Error 


31 24 | 23 16 | 15 8 | 7 0 
аааа аааа | nnnn nnnn |nnnn nnnn | пппп nnnn 


bit(s) description 
0x00 | ok 
0x01 | lid open 
0x02 | no disc/disc changed 
: 0x03 | no disc 
0x04 | motor off 
0x05 | disc not initialized/disc id not read 
0x000000 | ok 
0x020400 | Motor stopped 
0x020401 | Disk ID not read 
5.7.3.5.1 Error Codes 0x023A00 | Medium not present / Cover opened 
0x030200 | No Seek complete 
0x031100 | UnRecoverd read error 
0x040800 | Transfer protocol error 
^ 0x052000 | Invalid command operation code 
0x052001 | Audio Buffer not set 
0x052100 | Logical block address out of range 
0x052400 | Invalid Field in command packet 
0x052401 | Invalid audio command 
0x052402 | Configuration out of permitted period 
0x056300 | End of user area encountered on this track 
0x062800 | Medium may have changed 


0x0B5A01 | Operator medium removal request 


5.7.3.6 Play Audio Stream 
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5.7.3.7 Request Audio Status 


5.7.3.8 Stop Motor 


5.7.3.9 DVD Audio Disable 


5.7.3.10 DVD Audio Enable 


Action <- 1 


ACK (222) 


INIT (???) 
Status] <- 2Ah 


Status2 «- 0 


Status2 «- Status2 


Command/Subcommand/Padding <- E4010000 


5.7.4 DVD-ROM Subsystem 


> Matsushita MN103S13BGA Optical Disk Controller 


> Matsushita MN102H60GFA MicroComputer 


| 
5.7.4.1 Memory Мар 
| 


start end | size | description 
0x00008000 4kb internal (cpu) ram 
0x00080000 128kb | firmware rom (*) 
0x00400000 internal (controller) ram 
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(*) note: reading the firmware at its real location is prevented by the debug commands (imm buffer will not 
be changed at all). however you can read its contents from the memory mirrors, ie 0x000a0000-. 


5.8 SI- Serial Interface 


Register block Base | Size of Register block | common access size 
0xCC006400 0x100 4 

0xCC006400 | 4 | r/w | SICOOUTBUF - SI Channel 0 Output Buffer (Joy-channel 1 Command) 
0хСС00640с | 4 | r/w | SICIOUTBUF - SI Channel 1 Output Buffer (Joy-channel 2 Command) 
0xCC006418 | 4 | r/w | SIC2OUTBUF - SI Channel 2 Output Buffer (Joy-channel 3 Command) 
0xCC006424 | 4 | r/w | SICGOUTBUF - SI Channel 3 Output Buffer (Joy-channel 4 Command) 
31 24|23 16/|15 8 7 0 
bit(s) description 
24-31 unused/reserved 
16-23 CMD - (*1) 

8-15 OUTPUT? - (*2) 

0-7 OUTPUT! - (*3) 
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This register is double buffered, so main processor writes to the SICOOUTBUF will not interfere with 
the serial interface output transfer. Internally, a second buffer is used to hold the output data to be trans- 
ferred across the serial interface. To check if SICOOUTBUF has been transferred to the second buffer, main 
processor polls the SISR[WRSTO] register. When SICOOUTBUF is transferred, SISR[WRSTO] is cleared. 


(*1) This byte is the opcode for the command sent to the controller during each command/response packet. 
This is the first data byte sent from the SI I/F to the game controller in the command/response packet. 

(*2) This is the first data byte of the command packet. It is the second data byte sent from the SI I/F to the 
game controller in the command/response packet. 

(*3) This is the second data byte of the command packet. It is the third data byte sent from the SI I/F to the 
game controller in the command/response packet. 


0xCC006404 | 4 | r | Joy-channel 1 Buttons 1 | 
0xCC006410 | 4 | г | SICIINBUFH - SI Channel 1 Input Buffer High (Joy-channel 2 Buttons 1) 
4 |г 
r 


0xCC00641c Joy-channel 3 Buttons 1 
0xCC006428 | 4 Joy-channel 4 Buttons 1 
31 24 | 23 16 | 15 gi 0 

..5 yxba | ..LR  udrl | xxxx  xxxx | yyyy yyyy 


bit(s) Description 

31 ERRSTAT - Error Status (*1) 
0 | по error on last transfer | 
1 | error on last transfer | 
30 ERRLATCH - Error Latch (*2) 
0 | no error latched | 
1 | error latched (check SISR) | 
24-29 bit 0-5 of input byte 0 (bit 6 and 7 are assumed to be 0) 
16-23 input byte 1 

8-15 input byte 2 

0-7 input byte 3 


(*1) This bit represents the current error status for the last SI polling transfer on this channel. This register 
is updated after each polling transfer on this channel. 

(*2) This bit is an error status summary of the SISR error bits for this channel. If an error has occurred on 
a past SI transfer (polling or Com transfer), this bit will be set. To determine the exact error, read the SISR 
register. This bit is actually an ‘ог’ of the latched error status bits for this channel in Һе SISR. The bit is 
cleared by clearing the appropriate error status bits latched in the SISR. The no response error indicates 
that a controller is not present on thischannel. 
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0xCC006408 


r/w | Joy-channel 1 Buttons 2 


4 
0xCC006414 | 4 | r/w | Joy-channel 2 Buttons 2 

4 

4 


0xCC006420 r/w | Joy-channel 3 Buttons 2 
0xCC00642c r | SIC3INBUFL - SI Channel 3 Input Buffer Low (Joy-channel 4 Buttons 2) 


31 24 | 23 16 | 15 8 | 7 0 
XXXX хххх | уууу yyyy | 1111 1111 | rrer  rrrr 


bit(s) Description 
24-31 | x | input byte 4 
16-23 | y | input byte 5 
8-15 | 1 | input byte 6 

0-7 r | input byte 7 


SICOINBUFH and SICOINBUFL are double buffered to prevent inconsistent data reads due to main proces- 
sor conflicting with incoming serial interface data. To insure data read from SICOINBUFH and SICOINFUBL 
are consistent, a locking mechanism prevents the double buffer from copying new data to these registers. 
Once SICOINBUFH is read, both SICOINBUFH and SICOINBUFL are *locked* until SICOINBUFL is read. 
While the buffers are 'locked', new data is not copied into the buffers. When SICOINBUFL is read, the 
buffers become unlocked again. 


0xCC006430 | 4 | r/w | SIPOLL - SI Poll Register (Joy-channel Control (?) (Calibration gun ?)) 
31 24 | 23 16 | 15 817 0 
КТК КТГ cera || ceee 
bit(s) description 
26-31 unused/reserved 
16-25 X -7 X lines register (*1) 
8-15 Y - y times register (*2) 
4-7 e | EN - controller port enable (1 bit per port, 1: enabled) (*3) 
0-3 VBCPY - Vblank copy output channel (1 bit per port) (*4) 
| 0 | copy SICOUTBUF to output buffer after writing | 
| 1 | copy SICOUTBUF to output buffer only on vblank | 


(*1) 7 X lines register: determines the number of horizontal video lines between polling (the polling inter- 
val). The polling begins at vsync. 7 is the minimum setting (determined by the time required to complete 
a single polling of the controller). The maximum setting depends on the current video mode (number of 
lines per vsync) and ће SIPOLL[Y] register. This register takes affect after vsync. 

(*2) This register determines the number of times the SI controllers are polled in a single frame. This 
register takes affect after vsync. 

(*3) Enable polling of channel. When the channel is enabled, polling begins at the next vblank. When the 
channel is disabled, polling is stopped immediately after the current transaction. The status of this bit does 
not affect communication RAM transfers on this channel. 

(*4) Normally main processor writes to the SICOOUTBUF register are copied immediately to the channel 
0 output buffer if a transfer is not currently in progress. When this bit is asserted, main processor writes 
to channel 0’s SICOOUTBUF will only be copied to the outbuffer on vblank. This is used to control the 
timing of commands to 3D LCD shutter glasses connected to the VI. 
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0xCC006434 


4  r/w | SICOMCSR - SI Communication Control Status Register (command) 


31 24 


23 16 | 15 8 | 7 0 


E26. TEGS 


.mmm  mmmm | .nnn  nnnn | eb.. РЕ 


bit(s) 


description 


31 т 


TCINT - Transfer Complete Interrupt Status 


read | 0 | transfer complete interrupt not requested 


1 | transfer complete interrupt has been requested 


write | 0 | no effect 


1 | clear transfer complete interrupt 


30 


TCINTMSK - Transfer Complete Interrupt Mask (*1) 


0 | interrupt masked | 
1 | interrupt enabled | 


29 


COMERR - Communication Error 


0 | ok | 
1 | error (see SiSr for the cause) | 


28 


RDSTINT - Read Status Interrupt Status (*2) 


read | 0 | Transfer Complete Interrupt not requested 


1 | Transfer Complete Interrupt has been requested 


write | 0 


1 


27 


RDSTINTMSK - Read Status interrupt Mask (*3) 


0 | masked 
1 | enabled 


Channel Number (?) 


Channel Enable (?) 


unused/reserved 


OUTLNGTH - Communication Channel Output Length (*4) 


unused/reserved 


INLNGTH - Communication Channel Input Length (*4) 


Command Enable (?) 


callback enable 


bit | Description 
0 | no callback 
1 | callback enabled 


1-2 


CHANNEL - (*5) 


00 


Channel 1 


01 


Channel 2 


10 


Channel 3 


11 


Channel 4 
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0 TSTART - Transfer Start (*6) 
read | 0 | Command Complete 
1 | Command Pending 
write | 0 | Do not start command 
1 | Start command 


(*1) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect 
the assertion of SICOMCSR[TCINT] 

(*2) On read this bit indicates the current status of the Read Status interrupt. The interrupt is set whenever 
SISR[RDSTn] bits are set. The interrupt is cleared when all of ће RdSt bits in the SISR are cleared by 
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reading from the Si Channel Input Buffers. This interrupt can be used to indicate that a polling transfer has 
completed and new data is captured in the input registers 

(*3) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the 
assertion of SICOMCSR[RDSTINT] 

(*4) Minimum transfer is 1 byte. A value of О will transfer 128 bytes. These bits should not be modified 
while SICOM transfer is in progress. 

(*5) These bits should not be modified while SICOM transfer is in progress. 

(*6) When a '1* is written to this register, the current communication transfer is executed. The transfer be- 
gins immediately after the current transaction on this channel has completed. When read this bit represents 
the current transfer status. Once a communication transfer has been executed, polling will resume at the 
next vblank if the channel’s SIPOLL[ENn | bit is set. 


When programming the SICOMCSR after a SICOM transfers has already started (e.g., SICOMCSR[TSTART] 
is set), the software should read the current value first, then and/or in the proper data and then write the 
new data back. The software should not modify any of the transfer parameters (OUTLNGTH, INLNGTH, 
CHANNEL) until the current transfer is complete. This is done to prevent a SICOM transfer already in 
progress from being disturbed. When writing the data back, the software should not set the TSTART bit 
again unless the current transfer is complete and another transfer is required. 
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0xCC006438 | 4 | r/w | SISR - SI Status Register (channel select & status2) | 


31 24 | 23 16 | 15 8 | 7 0 
r??? аааа | 2222  bbbb | 2222  cccc | ???? айда 


bit(s) description 

31 т | WR- Write SICnOUTBUF Register (*1) 
read | 0 | buffer copied 
1 | buffer not copied 
write | 0 | no effect 
1 | copy all buffers 
30 reserved/unused 
29 RDSTO - Read Status SICOOINBUF Register (*2) 
0 | New data available, not read by main processor | 
1 | No new data available, already read by main processor | 
28 WRSTO - Write Status SICOOUTBUF Register (*3) 
0 | Buffer copied | 
1 | Buffer not copied | 
27 МОКЕРО - No Response Error Channel 0 (*4) 
read | 0 | No Response Error not asserted 
1 | No Response Error asserted 
write | 0 | No effect 
1 | Clear No Response Error 
26 COLLO - Collision Error Channel 0 (*5) 
read | 0 | Collision Error not asserted 

1 | Collision Error asserted 
write | 0 | No effect 
] | Clear Collision Error 

25 OVRUNO - Over Run Error Channel 0 (*6) 


read | O | Over Run Error not asserted 
1 | Over Run Error asserted 
write | O | Noeffect 
] | Clear Over Run Error 
24 UNRUN - Under Run Error Channel 0 (*7) 


read | 0 | Under Run not asserted | 
1 | Under Run asserted | 


write | 0 | No effect 
1 | Clear Under Run Error 


22-23 reserved/unused 

16-21 | b | Joy-channel 1 bits 

14-15 reserved/unused 
8-13 с | Joy-channel 2 bits 
6-7 reserved/unused 


0-5 | d | Joy-channel 3 bits 


(*1) Write SICnOUTBUF Register: This register controls and indicates whether the SICnOUTBUFs have 
been copied to the double buffered output buffers. This bit is cleared after the buffers have been copied. 
(*2) This register indicates whether the SICOINBUFs have been captured new data and whether the data has 
already been read by the main processor (read indicated by main processor read of SICOINBUF[ERRSTAT, 
ERRLATCH, INPUTO, INPUT1)] 

(*3) This register indicates whether the SICOOUTBUFs have been copied to the double buffered output 
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buffers. This bit is cleared after the buffers have been copied. 

(*4) This register indicates that a previous transfer resulted in no response from the controller. This can 
also be used to detect whether a controller is connected. If no controller is connected, this bit will be set. 
Once set this bit remains set until it is cleared by the main processor. To clear this bit write ‘1° to this 
register. 

(*5) This register indicates data collision between controller and main unit. Once set this bit remains set 
until itis cleared by the main processor. To clear this bit write *1* to this register. 

(*6) This register indicates that the main unit has received more data than expected. Once set this bit re- 
mains set until it is cleared by the main processor. To clear this bit write ‘1’ to this register. 

(*7) This register indicates that the main unit has received less data than expected. Once set this bit remain 
set until it is cleared by the main processor. To clear this bit write *1* to this register. 


0xcc00643c | 4 | R/W | SIEXILK - SI EXI Clock Lock 


31 24123 16 15 8,7 0 


bit(s) description 
31 LOCK - prevents CPU from setting EXI clock to 32MHz 
0 32МН? EXI clock setting permitted 
1 32MHz EXI clock setting not permitted 
0-30 unused/reserved (always zero) 


0xCC006480 | 0x80 | r/w | SI i/o buffer (access by word) | 


5.8.1 Operation 


5.8.1.1 Serial Send Buffer 


> select channel: unset all bits in Охсс006438 that are not corresponding to your channel and leave the 
others untouched. 


> Put output data into SI buffer (128 bytes maximum), word by word. 


> Send command: fill in °c’; m’; n’ and ’b’ bits of 0xcc006434 accordingly, and set bits ’s’ and ’e’. 
leave other bits untouched. 


5.8.1.2 Serial Get Result 


> simply read the SI buffer 


5.9 ЕХІ- External Interface 


Upper memory (0xCC000000 and above) can't keep enough data for extra-large arrays, it's limited up to 
OxFFFF bytes (suppose to be). EXI was designed to remove this limitation. EXI is used for access to big, 
unmapped areas of HW memory (such as bootrom or SRAM). This is the main task of EXI. Put another 
way, EXI can be used for providing access to slow, serial devices, such as memory cards. EXI is a complex 
of different devices, mapped to a single bus. The EXI bus is divided on 3 channels. Each channel has 3 
unique devices. Each device is defined by its ID, and has its own address space. 
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EXI can be accessed in immediate mode, or via DMA channel. Each EXI device can generate up to 3 
interrupts. They are called EXI, TC and EXT : 


EXI | Device EXI Interrupt 


TC Transfer Completed (any mode) 


EXT | Device Attached / Device Detached 


Each EXI channel have its own register set, 5 32bit Registers each. 


Register block Base 


Size of Register block 


common access size 


0xCC006800 


0x40 


4 
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0хСС006800 | 4 EXIOCSR - EXI Channel 0 Parameter Register (Status?) 
0xCC006814 | 4 EXIICSR - EXI Channel 1 Parameter Register 
0xCC006828 | 4 EXDCSR - EXI Channel 2 Parameter Register 


31 24123 16 15870 


bit(s) Description 
14-31 unused 
13 ROMDIS - (EXIO only) 1: rom de-scramble logic disabled (*1) 
12 d EXT - Device Connected Bit (R) 1 if a device is connected on the specific channel 
11 х EXTINT - External Insertion Interrupt Status (К) : check to poll EXT interrupt (or to detect device detach) ( 


| read | O | External Insertion Interrupt has not been requested 
| 1 | External Insertion Interrupt has been requested 


write | 0 | No effect 

1 | Clear External Insertion Interrupt 
10 m | EXTINTMASK - EXT Interrupt Mask (1 - enable, 0 - disable) (*5) 
7-9 210 | CS - devices selected on this channel, each bit selecting one device. (*) 
4-6 f | CLK - used frequency (0-5) 


000 | IMHz 
001 | 2MHz 
010 | 4MHz 
011 | SMHz 
100 | 16MHz 
101 | 32MHz 
110 | reserved 
111 | reserved 


3 t TCINT - Transfer Complete Interrupt Status 

read | O | Transfer Complete Interrupt has not been requested 
1 | Transfer Complete Interrupt has been requested 
write | 0 | No effect 

1 | Clear Transfer Complete Interrupt 

2 m | TCINTMASK - Transfer complete interrupt mask (1 - enable, 0 - disable) (*2) 
1 e EXTINT - Interrupt Status (*6) 

read | O | EXI Interrupt has not been requested 
1 | EXI Interrupt has been requested 
write | 0 | No effect 

1 | Clear EXI Interrupt 

0 m | EXTINTMASK - EXI interrupt mask (1 - enable, 0 - disable) 


(*)Only one of these three bits can be set to signify which device number has been selected on a specific channel. 


(*6) This bit indicates the current status of the EXIO interrupt. The interrupt is cleared by accessing the 
expansion device and clearing the interrupt on the device itself and cleared locally when а *1* is written to 
this register. This interrupt input is edge triggered. 

(*1) This bit disables access to the IPL Mask ROM attached to CS1. Once this bit is enabled, it can 
only be disabled again by global reset. The ROM de-scramble logic will become disabled and any reads 
to the memory mapped ROM area will return all 0.When de-scrambler is enabled all EXIO data will be 
de-scrambled, so only the IPL ROM may be accessed through EXIO until ROMDIS is set to ‘1’. (this is 
usually done by the Bootstrap, see Boot process details) 

(*2) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the 
assertion of TCINT 
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(*3) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the 
assertion of EXIINT 

(*5) Interrupt masking prevents the interrupt from being sent to the main processor, but does not affect the 
assertion of EXICPR[EXTINT] 

(*4) This interrupt indicates than an external EXI device has been removed from channel 1. To check 
whether the device has been inserted or removed, check the EXICPR[EXT] bit. When this bit is set, the 
channel's expansion EXI interface outputs go to high. 


0хсс006804 | 4 | r/w | EXIOMAR - EXI Channel 0 DMA Start Address 


0xCC006818 EXIIMAR - EXI Channel 1 DMA Start Address 


0xCC00682c EXDMAR - EXI Channel 2 DMA Start Address 


31 24 | 23 16 | 15 8 | 7 0 
..аа | dddd dddd | dddd аааа | ddd. 


Physical Startaddress for DMA transfer. Must be aligned to 32 byte boundary . 


(*) The memory address is the destination address when EXICR[RW] is set to ‘read‘ and is the source 
address when set to ‘write*. 


0xCC006808 | 4 | r/w | EXIOLENGTH - ЕХІ Channel 0 DMA Transfer Length 
0xCC00681c | 4 EXI Channel 1 DMA Transfer Length 
0xCC006830 | 4 EXI Channel 2 DMA Transfer Length 


31 24 | 23 16 | 15 8 | 7 0 
..аа | dddd dddd | dddd dddd | ddd. 


Size of DMA transfer data in bytes. bits 0-4 are always zero (which means the size is 32 byte aligned) 


0хСС00680с | 4 | r/w | EXIOCR - EXI Channel 0 Control Register 
0xCC006820 | 4 | r/w | EXIICR - EXI Channel 1 Control Register 
0xcC006834 | 4 | r/w | EXI2CR - EXI Channel 2 Control Register 


31 24 | 23 16 | 15 ӨЗІМ? 0 
ll ttme 
bit(s) Description 
6-31 . | unused 
4-5 ] | TLEN - (data length-1) for immediate mode 
00 | 1 byte 
01 | 2 bytes 
10 | 3 bytes 
11 | 4 bytes 
2-3 t | RW - transfer type 
00 | read 
01 | write 
10 | read and write, invalid for DMA 
11 | undefined 
1 т | DMA - transfer mode (0 - immediate, 1 - DMA) 
0 e | TSTART - set, to start transfer. will be cleared after transfer completed. 
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0xcC006810 | 4 | r/w | EXIODATA - EXI Channel 0 Immediate Data 
0хСС006824 | 4 | г/м | EXIIDATA - EXI Channel 1 Immediate Data 
0xcC006838 | 4 | r/w | EXI2DATA - EXI Channel 2 Immediate Data 


31 24 | 23 16 | 15 8 | 7 0 
dddd аааа | dddd аааа | дааа dddd | дааа  dddd 


Data for read / write immediate operations (up to 4 bytes long). 


The EXICPR must be configured to assert one of the devices CS, before the read or write operation 
can be performed. The actual read/write operation is triggered by the EXIOCR[TSTART] register and 
EXIOCR[DMA] set to ‘0°. Data is sent with MSB (bit 31) first. 


5.9.1 Operation 
5.9.1.1 Initializing the EXI Bus 


> clear all ЕХБ status registers (set to 0) 


> eventually initialize interrupt callbacks. 


If you want to use DMA with EXI, you need your own properly installed EXI interrupt handlers. There is 
no need in callbacks and interrupts, if you are using EXI in immediate mode (just mask all TCs, to prevent 
unhandled interrupts). 


5.9.1.2 Selecting a Specific EXI Device on an EXI Channel 
> set selected device number and frequency 210” and f fields in status register) 
> eventually enable any existing callbacks 
5.9.1.3 Deselecting EXI Devices on an EXI Channel 
> deselect device (clear corresponding '210' field) 
> eventually disable any existing callbacks 


5.9.1.4 Performing an IMM Operation on a EXI Device 


5.9.1.4.1 IMM Read 


> setup EXI Control Register (bit4-5:data length-1, bit2: O for read, bitl: 0 for immediate, bitl: 1 to 
start transfer) 


> wait until transfer has been completed (until bit 0 in EXI Control Register has been cleared) 


D- get data from EXI IMM Data Register (up to 4 bytes) 
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5.9.1.4.2 IMM Write 


> write data to EXI IMM Data Register (up to 4 bytes) 


> setup EXI Control Register (bit4-5:data length-1, bit2: 1 for write, БИТ: 0 for immediate, 0111: 1 to 
start transfer) 


> wait until transfer has been completed (until bit 0 in EXI Control Register has been cleared) 


5.9.1.5 Performing a DMA Operation on a EXI Device 


5.9.1.51 DMA Read 


setup DMA buffer address 
setup DMA length 


setup EXI Control Register (bit4-5:data length-1, bit2: 0 for read, bitl: 1 for DMA, bitl: 1 to start 
transfer) 


wait until transfer has been completed (until bit 0 in EXI Control Register has been cleared) 


5.9.1.5.2 DMA Write 


setup DMA buffer address 
setup DMA length 


setup EXI Control Register (bit4-5:data length-1, bit2: 1 for write, bitl: 1 for DMA, bitl: 1 to start 
transfer) 


wait until transfer has been completed (until bit 0 in EXI Control Register has been cleared) 


5.9.1.6 Wait for EXI transfer completed То detect the end of a transfer on a specific channel either 
setup a ’transfer completed’ callback (only works with DMA transfer) or periodically check bit 0 of the 
EXI Control Register (until cleared). 


5.10 AI - Audio Streaming Interface 


Registerblock Base | Size of Registerblock | common access size 
0xcc006c00 0x20 4 
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0xCC006C00 | r/w | 4 | АСК - Audio Interface Control Register 
31 24 | 23 16 | 15 8 | 7 0 
bit(s) Description 
7-31 reserved/unused 
6 DSP Sample Rate 
| 0 | 48 kHz sample rate | 
| 1 | 32 kHz sample rate | 
5 SCRESET Sample Counter Reset: When а ‘1‘ is written to this bit the AISLRCNT register is reset to 0 
4 AIINTVLD Audio Interface Interrupt Valid. 
This bit controls whether AIINT is affected by the AIIT register matching AISLRCNT. Once set, AIINT will ho 
0 | Match affects АПМТ | 
1 | АПМТ hold last value. | 
3 AIINT Audio Interface Interrupt Status and clear. (*3) 
r | 0 | Audio Interface Interrupt has not been requested 
1 | Audio Interface Interrupt has been requested. 
w | O | No effect 
1 | Clear Audio Interface interrupt 
2 AIINTMSK Audio interface Interrupt Mask 
0 | interrupt masked | 
1 | Interrupt enabled | 
1 AFR: Auxiliary Frequency Register (*1) 
0 | 48 kHz sample rate | 
1 | 32 kHz sample rate | 
0 PSTAT: Playing Status 
0 | Stop or Pause streaming audio (AISLR clock disabled) | 
1 | Play streaming audio (AISLR clock enabled) | 
(53) 


On read this bit indicates the current status of the audio interface interrupt. When a ‘1‘ is written to this 
register, the interrupt is cleared. This interrupt indicates that the AIIT register matches the AISLRCNT. 
This bit asserts regardless of the setting of AICR[AIMSK]. 


(*1) 


Controls the sample rate of the streaming audio data. When set to 32 kHz sample rate, the SRC will convert 
the streaming audio data to 48 kHz. This bit should only be changed when Streaming Audio is stopped 
(AICR[PSTAT] set to 0). 


(“0) 


This bit enables the AISLR clock which controls the playing/stopping of audio streaming. When this bit is 
1 AISLRCNT register will increment for every stereo pair of samples output. 
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0xCC006C04 | r/w | 4 | AIVR - Audio Interface Volume Register 


31 24 | 23 16 | 15 8 | 7 0 
rrrr rrrr |1111 LELI 


bit(s) description 

16-31 unused/reserved 

8-15 | r | AVRR - Volume Right Channel (0x00 is muted,Oxff is max) 
0-7 1 | AVRL - Volume Right Channel (0x00 is muted,Oxff is max) 


0хСС006С08 | r | 4 | AISCNT - Audio Interface Sample Counter 


Audio interface Sample Counter: This register counts the number of AIS stereo samples that have been 
output. It is enabled by AICR[PSTAT]. It can be cleared by the AICR[SCRESET] register. 


0xCC006COC | r/w | 4 | АПТ - Audio Interface Interrupt Timing 


This register indicates the stereo sample count to issue an audio interface interrupt to the main proces- 
sor. The interrupt is issued when the value of the AISLRCNT register matches the content of this register. 


5.11 GX FIFO (Graphic display lists) 


GP have mapped 32-byte FIFO buffer, at OxCC008000, which is controlled by write gather pipe (МРАК). 
when FIFO is filled (or overloaded by 32-bytes), WPAR performs burst transaction of primitive data to GP 
command FIFO. WPAR API also keeps watching for wrapping it on 32-buffer. You can think, that data is 
always looped and flows like in circle. 


Registerblock Base | Size of Registerblock | common access size 
0хсс008000 4 алу 


To access FIFO, you should just write data of any size to OxCC008000, WPAR will control circularity 
and gathering automatically. By "data of any size" are assumed command types, vertices, vertex attributes 
etc stuff. All commands and primitive data are sending through mapped GP FIFO. GP task is only to draw 
primitives in embedded frame buffer, and then send it to XFB, for VI rendering. All render rules are stored 
in VI. GP can only change some copy rules, using pixel engine setup. 


GP primitives also can be drawn, using Display List. In that case, GP FIFO takes only "CALL DL" 
command with pointer to list data, and then GP command FIFO sequentially parsing primitive data from 
the main memory. Primitives can contains both direct and indexed vertexes as well. In first case, vertex 
attributes are sent directly using GP FIFO, in the other case the CPU sends only the pointer to vertex at- 
tribute data which is located in main memory. 


5.11.1 internal BP registers 


Registerblock Base | Size of Registerblock | common access size 
0x00 0x100 4 (1+3) 
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Register | Description 
0x00 GEN_MODE 
0х01 display copy filter 
0x02 display copy filter 
0x03 display copy filter 
0x04 display copy filter 
0x05 ? 
0x06 IND MTXAO 
0x07 IND MTXBO 
0x08 IND MTXCO 
0x09 IND MTXAI 
0x0a IND MTXBI 
0x0b IND MTXCI 
0x0c IND MTXA2 
0x0d IND MTXB2 
0x0e IND MTXC2 
0х0Ғ IND_IMASK 
0x10 IND. CMDO - tev indirect 0 
0х11 IND_CMD1 - tev indirect 1 
0x12 IND. CMD2 - tev indirect 2 
0x13 IND. CMD93 - tev indirect 3 
0x14 IND. CMDA - tev indirect 4 
0x15 IND. CMD95 - tev indirect 5 
0x16 IND. CMD6 - tev indirect 6 
0x17 IND. CMD7 - tev indirect 7 
0x18 IND. CMDS - tev indirect 8 
0x19 IND. CMD9? - tev indirect 9 
Oxla IND_CMDA - tev indirect 10 
0х1р IND_CMDB - tev indirect 11 
0хіс IND_CMDC - tev indirect 12 
0х1а IND_CMDD - tev indirect 13 
Oxle IND_CMDE - tev indirect 14 
0х1ғ IND. CMDF - tev indirect 15 
0x20 scissor x0,yO (0x20156156) 
0x21 scissor x1,y1 (0х21345335) 
0x22 SU LPSIZE - field mode .. line width - point width 
0x23 SU Counter (?) (0x23000000) 
0x24 RAS Counter (?) (0x24000000) 
0x25 RAS1_SSO - ind tex coord scale 0 
0x26 RASI, SS1 - ind tex coord scale 1 
0x27 КА$1 IREF 
0x28 RAS1_TREFO - tev order 0 
0x29 RASI, TREFI - tev order 1 
0x2a RAS1, TREE2 - tev order 2 
0x2b RAS1_TREF3 - tev order 3 
0х2с RAS1_TREF4 - tev order 4 
0х2а RAS1_TREF5 - tev order 5 
0х2е RAS1_TREF6 - tev order 6 


RAS1_TREF7 - tev order 7 
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Register | Description 
0x30 SU. SSIZEO - texture offset 0 (Texture Size X, Y 2) 
0x31 SU TSIZEO - 
0x32 SU. SSIZEI - texture offset 1 
0x33 SU TSIZEI - 
0x34 SU. SSIZE2 - texture offset 2 
0x35 SU TSIZE2 - 
0x36 SU SSIZE3 - texture offset 3 
0x37 SU TSIZE3 - 
0x38 SU. SSIZEA - texture offset 4 
0x39 SU TSIZEA - 
0x3a SU SSIZES - texture offset 5 
0x3b SU TSIZES - 
0x3c SU SSIZE6 - texture offset 6 
0x3d SU TSIZEG - 
0x3e SU. SSIZE7 - texture offset 7 
0х3Ғ SU_TSIZE7 - 
0x40 PE_ZMODE set z mode 
0х41 РЕ CMODEO dithering / blend mode/color_update/alpha_update/set_dither 
0x42 РЕ СМОРЕІ destination alpha 
0x43 PE, CONTROL comp z location z_comp_loc(0x43000040)pixel_fmt(0x43000041) 
0x44 field mask (0x44000003) 
0x45 PE DONE - draw done (end of list marker) ? 
0x46 some clock ? (0x46000000]|(((162000000/500)/4224)|0x0200)) 
0x47 PE TOKEN token B (16 bit) 
0x48 PE TOKEN INT token A (16 bit) 
0x49 EFB source rectangle top left 
0x4a EFB source rectangle width, height-1 
0x4b XFB target address 
0x4c ? 
0x4d stride ? 
0x4e DispCopyYScale 
Ох4Е РЕ copy clear AR - set clear alpha and red components 
0x50 PE copy clear GB - green and blue 
0х51 РЕ сору clear Z - 24-bit Z value 
0x52 pe copy execute? 
0x53 copy filter 
0x54 copy filter 
0x55 bounding box (0x550003ff) 
0x56 bounding box (0x560003ff) 
0x57 ? 
0x58 ? (0x5800000f) 
0x59 scissor-box offset (0x5902acab) 
0x5a ? 
0x5b ? 
0x5c 2 
0х5а ? 
0х5е ? 
0x5f ? 
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Register | Description 
0x60 ? 
0x61 ? 
0x62 ? 
0x63 ? 
0x64 TX, LOADTLUTO 
0x65 TX LOADTLUTI 
0x66 ? 
0x67 metric ? (0x67000000) 
0x68 field mode 
0x69 some clock ? (0x69000000|((((162000000/500)> > 1 1) &OxOOffffff))|0x0400) 
Охба ? 
0x6b ? 
0x6c ? 
0x6d ? 
0x6e ? 
ОхбЕ ? 
0x70 ? 
0х71 ? 
0х72 ? 
0х73 ? 
0х74 
0х75 ? 
0x76 ? 
0х77 ? 
0х78 ? 
0х79 ? 
0х7а ? 
0х7р ? 
0х7с ? 
0х7а ? 
0х7е ? 
0х7Ё ? 
0х80 TX_SETMODE0_IO - 0x90 for linear 
0х81 TX SETMODEO 11 
0x82 TX SETMODEO 12 
0x83 TX SETMODEO I3 
0x84 TX, SETMODEI 10 
0x85 TX SETMODEI 11 
0x86 TX SETMODEI I2 
0x87 TX SETMODEI I3 
0x88 TX SETIMAGEO 10- texture size ? 
0x89 TX, SETIMAGEO П 
0x8a TX SETIMAGEO I2 
0x8b TX SETIMAGEO I3 
0x8c TX. SETIMAGEI 10 
0x8d TX, SETIMAGEI П 
0x8e TX SETIMAGEI I2 
0x8f TX, SETIMAGEI I3 
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Register | Description 
0x90 TX SETIMAGE2 10 
0x91 TX SETIMAGE2 П 
0x92 TX SETIMAGE2 12 
0x93 TX SETIMAGE2 I3 
0x94 TX ЗЕТІМАСЕЗ 10- Texture Pointer 
0x95 TX SETIMAGE3 П 
0x96 TX SETIMAGE3 I2 
0x97 TX ЗЕТІМАСЕЗ I3 
0x98 TX LOADTLUTO 
0x99 TX LOADTLUTI 
0x9a TX LOADTLUT2 
0x9b TX LOADTLUT3 
0x9c ? 
0x9d ? 
0x9e ? 
0х9# ? 
0xa0 TX SETMODEO I4 
0xal TX SETMODEO I5 
0xa2 TX SETMODEO I6 
0xa3 TX SETMODEO I7 
0xa4 TX SETMODEI I4 
0xa5 TX SETMODEI 15 
0xa6 TX SETMODEI I6 
0xa7 TX SETMODEI I7 
0xa8 TX SETIMAGEO I4 
0xa9 TX SETIMAGEO I5 
0xaa TX SETIMAGEO I6 
0xab TX SETIMAGEO I7 
0xac TX SETIMAGEI I4 
0xad TX SETIMAGEI I5 
0xae TX SETIMAGEI I6 
Oxaf TX SETIMAGEI I7 
Oxb0 TX SETIMAGE2 I4 
Oxbl TX SETIMAGE2 I5 
0xb2 TX SETIMAGE2 I6 
0xb3 TX SETIMAGE2 I7 
0xb4 TX SETIMAGE3 I4 
0xb5 TX SETIMAGE3 I5 
0xb6 TX SETIMAGE3 I6 
Oxb7 TX SETIMAGE3 I7 
0xb8 TX SETTLUT I4 
0xb9 TX SETTLUT I5 
0xba TX SETTLUT I6 
Oxbb TX_SETTLUT_I7 
Oxbe ? 
Oxbd ? 
Oxbe 2 
Oxbf ? 
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Register | Description 
0хс0 TEV_COLOR_ENV_0 - tev op 0 
Oxcl TEV_ALPHA_ENV_0 - tev op 1 
0хс2 TEV_COLOR_ENV_1 - 
0хс3 ТЕУ_АГРНА_ЕМУ_1 
0хс4 ТЕУ COLOR ЕМУ 2 - 
0хс5 ТЕУ АГРНА ЕМУ 2 
0xc6 TEV COLOR ENV 3- 
0хс7 TEV_ALPHA_ENV_3 
0xc8 TEV COLOR ENV 4- 
0xc9 TEV ALPHA ENV 4 
0xca TEV COLOR ENV 5- 
0xcb TEV ALPHA ENV 5 
0xcc TEV COLOR ENV 6- 
0xcd TEV ALPHA ENV 6 
Oxce TEV_COLOR_ENV_7 - 
Oxcf TEV_ALPHA_ENV_7 
0ха0 TEV_COLOR_ENV_8 - 
0ха1 ТЕУ_АГРНА_ЕМУ_8 
0ха2 TEV_COLOR_ENV_9 - 
0xd3 TEV ALPHA ENV 9 
0xd4 TEV COLOR ENV A- 
0xd5 TEV ALPHA ENV A 
0xd6 TEV COLOR ENV B- 
0xd7 TEV ALPHA ENV B 
0xd8 TEV COLOR ENV C- 
0xd9 TEV ALPHA ENV C 
0xda TEV COLOR ENV D- 
Oxdb TEV_ALPHA_ENV_D 
0xdc TEV COLOR ENV E- 
0xdd TEV ALPHA ENV E 
0xde TEV COLOR ENV F- 
Oxdf TEV_ALPHA_ENV_F 
0хе0 ТЕУ REGISTERL 0 
Oxel TEV REGISTERH 0 
0xe2 TEV REGISTERL 1 
0xe3 TEV REGISTERH 1 
0xe4 TEV REGISTERL 2 
0xe5 ТЕУ REGISTERH 2 
0xe6 TEV REGISTERL 3 
0xe7 TEV REGISTERH 3 
0xe8 Fog Range (0xe8000156) 
0xe9 ? 
0xea ? 
Oxeb ? 
Oxec ? (guessed: tev_range_adj_c) 
0xed ? (guessed: tev range adj k) 
Oxee TEV_FOG_PARAM_0 (Oxee03ce38) 
Oxef ТЕУ РОС PARAM 1 (Oxef471c82) 
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Register | Description 
0хҒ0 TEV_FOG_PARAM_2 (0xf0000002) 
Oxfl TEV_FOG_PARAM_3 (0xf1000000) 
Oxf2 TEV_FOG_COLOR (0xf2000000) 
0x£3 ТЕУ ALPHAFUNC - alpha compare (0х#33#0000) 
Oxf4 TEV_Z_ENV_0 - z texture 0 
Oxf5 TEV_Z_ENV_1 - z texture 1 
Oxf6 TEV_KSEL_0 - Tev Swap Mode Table 0 (0xf6018064) 
Oxf7 TEV. KSEL 1 - Tev Swap Mode Table 1 (0xf701806e) 
0xf8 TEV KSEL 2- Tev Swap Mode Table 2 (0xf8018060) 
0х#9 TEV_KSEL_3 - Tev Swap Mode Table 3 (Oxf901806c) 
Oxfa TEV_KSEL_4 - Tev Swap Mode Table 4 (Oxfa018065) 
Oxfb TEV_KSEL_5S - Tev Swap Mode Table 5 (Oxfb01806d) 
ОхЕс TEV_KSEL_6 - Tev Swap Mode Table 6 (0xfc01806a) 
Oxfd TEV_KSEL_7 - Tev Swap Mode Table 7 (Oxfd01806e) 
Oxfe SS_MASK - BP Mask Register 
Oxff 2 
0x00 | 4 | w | GEN MODE 
31 24|23 16 1587 0 
bit(s) description 
24 RID 
19 ZFREEZE 
16 NBMP - Number of Bumpmaps 
14-15 REJECT_EN - Culling Mode 
0 | none 
1 | negative 
2 | positive 
3 | all 
10 NTEV 
9 MS EN 
4 NCOL - Number of Colors 
0 NTEX - Number of Texture Coords 
0x01 | 4 | w | display copy filter 
0x02 | 4 | w | display copy filter 
0x03 | 4 | w | display copy filter 
0x04 | 4 | м | display copy filter 
0x05 | 4| w |? 
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0x06 w | IND MTXAO 
0x09 w | IND MTXAI 
0x0c w | IND MTXA2 
31 24|23 16 15 817 
bit(s) description 

24 RID 

22 S 

11 MB 

0 MA 
0x07 w | IND MTXBO 
0x0a w | IND MTXBI 
0x0d w | IND MTXB2 
3L 24. | 235 16. 15. . 8 "7 
bit(s) description 

24 RID 

22 S 

11 MD 

0 MC 
0x08 w | IND MTXCO 
0x0b w | IND_MTXCl 
0x0e w | IND MTXC2 
ЗА 24 2 2-62 2289281 
bit(s) description 

24 RID 

22 5 

11 МЕ 

0 МЕ 
0x0f w | IND IMASK 
31 24|23 16 15 8 7 
bit(s) description 

24 RID 

0 IMASK 


0x10 


IND CMDO | 
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0x11 | 4 | w | IND CMDI 
0x12 | 4 | м | IND CMD2 
0x13 | 4 | м | IND CMD3 
0x14 | 4 | м | IND_CMD4 
0x15 | 4 | м | IND CMD5 
0x16 | 4 | м | IND CMD6 
0x17 | 4 | м | IND CMD7 
0x18 | 4 | м | IND_CMD8 
0x19 | 4 | м | IND CMD9 
Oxla | 4 | w | IND CMDA 
0х1р | 4 | м | IND CMDB 
0х1с | 4 | м | IND CMDC 
0х1а | 4 | м | IND CMDD 
Oxle | 4 | w | IND CMDE 
Oxlf | 4 | w | IND CMDF 
31 24 | 23 16 15 817 
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bit(s) 


description 


24 


RID 


21-23 


PADO - padding zeros 


20 


FB - addprev 


19 


LB - utclod 


16-18 


TW - Wrap T 


0 | ITW_OFF 
1 | ITW_256 
2 | ITW_128 
3 | ITW_64 
4 | ITW 32 
5 

6 

7 


ITW_16 
ITW 0 


13-15 


n 
= 


- Wrap $ 


ITW_OFF 
ITW_256 
ITW_128 
ITW_64 
ITW_32 
ITW_16 
ITW 0 


YD) MB] WD] ә = 


M - Matrix ID 


0 | ITM_OFF 
1 | ITM_O 
2 | ITM_1 
3 | ITM_2 
5 | ITM_SO 
6 

7 


ITM_S1 
ITM_S2 
9 | ITM_TO 
10 | ІТМ TI 
11 | ITM Т2 


7-8 


BS - Alpha Selection 


0 | ITBA_OFF 
1 | ITBA_S 
2 | ITBA_T 
3 | ITBA_U 


4-6 


BIAS 


ITB_NONE 
ITB_S 
ITB_T 
ITB_ST 
ITB_U 
ITB_SU 
ITB_TU 
ITB_STU 


Ям MN BY] DW] ә | oO 


2-3 


FMT - Format 


0 | ITE 8 
1 | ITE 5 
2 | ITF4 
3 | ПЕЗ 


0-1 


BT - Indirect Tex Stage ID (0-3) 
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0x20 w | SU_SCISO - Scissorbox Top Left Corner 
3l 2423 16 |15; Вр 7-0 
bit(s) description | 
24 RID | 
12 ХО - Scissorbox ХО offset + 342 | 
0 YO - Scissorbox YO offset + 342 | 
0х21 w | SU. SCISI - Scissorbox Bottom Right Corner 
31. - 24 |.23- 6. 15 .8.'7 270 
bit(s) description | 
24 RID | 
12 ХІ - Scissorbox ХІ offset + 342 | 
0 Y1 - Scissorbox Y1 offset + 342 | 
0х22 w | SU_LPSIZE | 
31 24 |23 16 15 8 7 0 
bit(s) description 
24 RID 
23 PADO 
22 LINEASPECT 
19 PTOFF 
0 | toO 
1 | to 16th 
2 | to 8th 
3 | to Ath 
4 | to half 
5 | tol 
16 LTOFF 
0 | toO 
1 | to 16th 
2 | to 8th 
3 | to Ath 
4 | to half 
5 | tol 
8 PSIZE 
0 LSIZE 
0x23 w | SU Counter ? 
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0x24 | 4 | w | RAS Counter ? 
0x25 | 4 | w | RASI_SS - ind tex coord scale 0 | 
SL 24"). 235-126) ) 1587 9 
bit(s) description 
24 RID 
12 TS1 - Ind. Tex Stage 1 
8 SS1 - Ind. Tex Stage 1 
4 TSO - Ind. Tex Stage 0 
0 SSO - Ind. Tex Stage 0 
0x26 | 4 | w | RASI SS - ind tex coord scale 1 
31.-24.] 23. X6 |-19. 781072 0 
bit(s) description 
24 RID 
12 TS1 - Ind. Tex Stage 3 
8 SS1 - Ind. Tex Stage 3 
4 TSO - Ind. Tex Stage 2 
0 SSO - Ind. Tex Stage 2 
0x27 | 4 | м | ВАЅІ IREF 
3l 124: |123. 16"). 15- $1.2 0 
bit(s) description 
24 RID 
21 BC3 - Ind. Tex Stage 3 NTexCoord 
18 BIB - Ind. Tex Stage 3 NTexMap 
15 BC2 - Ind. Tex Stage 2 NTexCoord 
12 ВІ2 - Ind. Tex Stage 2 NTexMap 
9 ВС! - Ind. Tex Stage 1 NTexCoord 
6 ВП - Ind. Tex Stage 1 NTexMap 
3 BCO - Ind. Tex Stage 0 NTexCoord 
0 BIO - Ind. Tex Stage 0 NTexMap 


104 


HARDWARE REGISTERS 


0x28 | 4 | м | RASI TREFO 
0x29 | 4 | w | RASI TREFI 
0x28 | 4 | w | RASI_TREF2 
0х2р | 4 | м | RASI TREF3 
0x20 | 4 | w | RASI_TREF4 
0х2а | 4 | w | КАЅІ TREF5 
0х2е | 4 | w | RASI_TREF6 
0x2£ | 4 | w | RASI_TREF7 
31 24) 23 16115 8 7 0 
bit(s) description 
24 RID 
22 PAD1 
19-21 ССІ - Ind. Tex Stage 1 Channel ID 
0 | ColorO 
1 | Colori 
2 | AlphaO 
3 | Alphal 
4 | Color0A0 
5 | ColorlAl 
6 | ColorZero 
7 | Bump 
18 ТЕ1 - Ind. Tex Stage 1 TexMap enable 
15 ТСТ - Ind. Tex Stage 1 TexCoord 
12 TH - Ind. Tex Stage 1 TexMap 
10 PADO 
7 CCO - Ind. Tex Stage 0 Color ID 
6 TEO - Ind. Tex Stage 0 TexMap enable 
3 TCO - Ind. Tex Stage 0 TexCoord 
0 TIO - Ind. Tex Stage 0 TexMap 
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0x30 | 4 | w | SU_SSIZEO 

0x32 | 4 | w | SU_SSIZE1 

0x34 | 4 | w | SU_SSIZE2 

0x36 | 4 | w | SU_SSIZE3 

0x38 | 4 | w | SU_SSIZE4 

0x3a | 4 | w | SU. SSIZES 

0x3c | 4 | w | SU_SSIZE6 

0x3e | 4 | у | SU_SSIZE7 

31 24|23 16 1587 0 

bit(s) description 
24 RID 
19 PF - texcoord offset for points enable 
18 LF - texcoord offset for lines enable 
17 WS - s-cylindrical texcoord wrapping enable 
16 BS - s-range bias enable 
0 SSIZE - s-scale value -1 (U16) 

0x31 | 4 | w | SU_TSIZEO 

0x33 | 4 | у | SU TSIZEI 

0x35 | 4| у | SU_TSIZE2 

0x37 | 4 | w | SU_TSIZE3 

0x39 | 4 | у | SU_TSIZE4 

0x3b | 4 | у | SU TSIZES 

0хза | 4 | w | SU_TSIZE6 

Ox3f | 4 | у | SU_TSIZE7 

31 24|23 16 1587 0 

bit(s) description 
24 RID 
17 WT - t-cylindrical texcoord wrapping enable 
16 BT - t-range bias enable 
0 TSIZE - t-scale value -1 (U16) 
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0x40 | 4 | w | PE ZMODE | 


31 24.23 16115 8/7 0 


bit(s) description 
24 RID 
4 MASK - Update enable 
1 FUNC - Z-Buffer Compare Function 
0 | NEVER 
1 | LESS 
2 | EQUAL 
3 | LEQUAL 
4 | GREATER 
5 | NEQUAL 
6 | GEQUAL 
7 | ALWAYS 
0 ENABLE - Z-Buffer enable 
0x41 | 4 | w | PE CMODEO | 


31 .24.| 23. 16 | 15..8- 7 0 


bit(s) description 

24 RID 

12 LOGICOP 
CLEAR 
AND 
REVAND 
COPY 
INVAND 
NOOP 
XOR 
OR 
NOR 
EQUIV 
INV 
REVOR 
INVCOPY 
INVOR 
NAND 
15 | SET 
BLENDOP 
SFACTOR 
DFACTOR 
ALPHA. MASK 
COLOR, MASK 
DITHER ENABLE 
LOGICOP ENABLE 
BLEND ENABLE 


owl Bl SP | о чолоо о 


к- 
к- 


SO] = N| вл o0 


5 HARDWARE REGISTERS 


0x42 | 4 | w | PE CMODEI | 
3l. 24.| 23- X6-|-19-..8.| 7.10. 
bit(s) description 
24 RID 
8 CONSTANT_ALPHA_ENABLE 
0 CONSTANT_ALPHA 
0x43 | 4 | w | PE CONTROL 
31 24|23 16 1587 0 
bit(s) description 
24 RID 
7-23 unused ? 
6 Z Comp Loc (1: before tex) 
3-5 Z Format 
0 | linear 
1 | near 
2 | mid 
3 | far 
0-2 Pixel Format 
0 | RGB8 724 
1 | RGBA6 724 
2 | RGB565_Z16 
3 | 724 
4 | Y8 
5 | U8 
6 | V8 
7 | YUV420 
0x44 | 4 | w | field mask ? 
31 24|23 16 15870 
bit(s) description 
24 RID 
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0x45 w | PE_DONE - draw done 
Зе 24: 223 S16. LSA 484700270 
bit(s) description 

24 RID 

1 l=end of list 

0 ? 
0x46 w | ? (some clock?) 
Sd, 248 | 23. :L6-| 19- 8:0 
bit(s) description 

24 RID 

9 ? (must be 1) 

0 ((162000000/500)/4224) 


0x47 | 4 | w | PE_TOKEN | 


31 24 |23 16 15 8 7 0 
bit(s) description 
24 RID 
0 Token 
0x48 w | PE_TOKEN_INT 
31 24 |23 16 15 8 7 0 
bit(s) description 
24 RID 
0 
0x49 w | EFB Address Top Left 
31 24|23 16 15 8 7 0 
bit(s) description 
10 Y coordinate 


X coordinate 
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5 HARDWARE REGISTERS 


0х4а w | ЕЕВ Address Width, Height-1 
31 24 |23 1611587 0 
bit(s) description 
10 Height-1 
0 Width 
0x4b w | XFB Address 
31 24 |23 16/|15 8 7 0 
bit(s) description 
24 RID 
0 physical XFB Address > > 5 
0х4с у |? 
0х4а w | stride ? 
0х4е w | DispCopyYScale | 
31 24 | 23 16 | 15 8117 0 
bit(s) Description 
24 RID 
0 YSCALE - ((u32)(256.0/Y SCALEIN))&0x1 ff 
0х4Ғ w | РЕ сору clear АК - set clear alpha and red components | 
31 24 | 23 16 | 15 Ве 0 
bit(s) Description 
24 RID 
8 A 
0 R 
0x50 w | PE сору clear GB - green and blue 
31 24 | 23 16 | 15 8117 0 
bit(s) Description 
24 RID 
8 G 
0 B 
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0х51 w | РЕ сору clear Z - 24-bit Z value 
31 24 | 23 16 | 15 8117 
bit(s) Description 
24 RID 
0-23 Z - 24bit Z-Value 
0x52 w | pe copy execute? 
31 24 | 23 16 | 15 8 [7 
bit(s) Description 
24 RID 
14 execute ? (1: to XFB 0: to texture ?!) 
12-13 Frame 2 Field Mode 
11 clear (1: clear ЕЕВ) 
10 1: (256-(u32)(256.0/YSCALEIN)) > 0 
9 ? 
7-8 disp copy gamma 
4 target (XFB) pixel format 
1 clamp 
0 clamp 
0x53 w | copy filter 
0x54 w | copy filter 
0x55 w | bounding box 
0x56 w | bounding box 
0x57 у |? 
0х58 у |? 
0х59 w | Scissorbox Offset 
312 24] 23- 16 15-8 |. 4-.:0 
bit(s) description 
24 RID 
10 YO - ((Scissorbox Y offset + 342)» >1) 
0 XO - ((Scissorbox X offset + 342)» > 1) 


note: regs 0x5a-0x63 are left out (all unknown) 
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5 HARDWARE REGISTERS 


0x64 | 4 | w | TX LOADTLUTO 


31 24.) 23° 16 |15..8. 7-10 


bit(s) description 
24- rid 

21- райо 

0- tlut base 


0x65 | 4 | w | TX LOADTLUTI 


31 24123 16 15 8/7 0 


bit(s) description 
24- rid 
21- padO 
10- count 
0 tmem offset 
0x66 | 4| м 


0x67 | 4 | w | metric ? 


0x68 | 4 | м | field mode 


31 24123 16 15 8/7 0 


bit(s) description 
24 RID 
10 ? (must be 1) 
0 ((162000000/500)> >11) 


note: regs 0x6a-0x7f are left out (all unknown) 
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0x80 | 4 | м | TX SETMODEO 10- Texture lookup and filtering mode 
0x81 | 4 | w | TX SETMODEO П - Texture lookup and filtering mode 
0x82 | 4 | w | TX SETMODEO 12 - Texture lookup and filtering mode 
0x83 | 4 | м | TX SETMODEO ІЗ - Texture lookup and filtering mode 
0xa0 | 4 | м | TX SETMODEO 14- Texture lookup and filtering mode 
0ха1 | 4 | w | TX SETMODEO 15 - Texture lookup and filtering mode 
0xa2 | 4 | w | TX SETMODEO I6 - Texture lookup and filtering mode 
0xa3 | 4 | w | TX SETMODEO 17 - Texture lookup and filtering mode 
31 24|23 16/|15 8 7 0 


bit(s) description 

24 RID 

21 LODCLAMP / BIASCLAMP 
0 | off | 
1 | on | 
19 MAXANISO 
011 
1 | 2 (requires edge LOD) 
2 | 4 (requires edge LOD) 
3 | unused/reserved 
9 LODBIAS (52.5) 
8 DIAGLOAD 
0 | edge LOD | 
І | diagonal LOD | 
5 MIN FILTER 
O | near 
] | near mip near 
2 | near mip lin 
3 | unused/reserved 
4 | linear 
5 
6 
7 


lin mip near 

lin mip lin 
unused/reserved 
4 MAG FILTER 

0 | near | 

1 | linear | 

2 WRAP T 

0 | clamp 

1 | repeat (*) 

2 | mirror (*) 

3 | unused/reserved 
0 WRAP S (same as WRAP T) 


(*) requires the texture size to be a power of two. (wrapping is implemented by a logical AND (SIZE- 


D» 


HARDWARE REGISTERS 


0x84 | 4 | w | TX SETMODEI I0 - LOD Info 
0x85 | 4 | w | TX SETMODEI П - LOD Info 
0x86 | 4 | w | ТХ ЅЕТМОРЕІ 12 - LOD Info 
0x87 | 4 | w | ТХ ЅЕТМОРЕІ 13 - LOD Info 
0ха4 | 4 | w | TX SETMODEI 14 - LOD Info 
0ха5 | 4 | м | TX SETMODEI 15 - LOD Info 
0xa6 | 4 | w | TX SETMODEI 16 - LOD Info 
0xa7 | 4 | м | TX SETMODEI I7 - LOD Info 
31 24) 23 16 15 8/7 0 


bit(s) description 

24 RID 

8 MAX LOD (U4.4) 

0 MIN LOD (U4.4) 
0x88 | 4 | м | SETIMAGEO 10- Texture width, height, format 
0x89 | 4 | м | SETIMAGEO II - Texture width, height, format 
0х8а | 4 | w | SETIMAGEO І2- Texture width, height, format 
0x80 | 4 | м | SETIMAGEO ІЗ - Texture width, height, format 
0xa8 | 4 | w | SETIMAGEO_I4 - Texture width, height, format 
0xa9 | 4 | w | SETIMAGEO I5 - Texture width, height, format 
Охаа | 4 | w | SETIMAGEO I6 - Texture width, height, format 
Oxab | 4 | w | SETIMAGEO I7 - Texture width, height, format 
31 -24-[|,23 - 16 |158 т 'Q 


bit(s) description 


24- rid 


20- format 


14 

18 

ІА4 

ІА8 

RGB565 
RGB5A3 
RGBAS8 
unused/reserved 
C4 

C8 

С14Х2 
unused/reserved 
unused/reserved 
unused/reserved 
CMP 

15 | unused/reserved 


моно OC] ©) AP) WP AP оо о 


ERN 
AR 


10- height - 1 


0- width - 1 


HARDWARE REGISTERS 


0х8с | 4 | м | TX SETIMAGEI 10 - even LOD address in TMEM 
0х8а | 4 | w | TX ЅЕТІМАСЕІ II - even LOD address in TMEM 
0х8е | 4 | w | TX SETIMAGEI 12 - even LOD address in TMEM 
0х8Ғ | 4 | w | TX SETIMAGEIL 13 - even LOD address in TMEM 
Oxac | 4 | м | TX SETIMAGEI 14 - even LOD address in TMEM 
Oxad | 4 | w | TX SETIMAGEI I5 - even LOD address in TMEM 
Oxae | 4 | м | TX SETIMAGEI 16 - even LOD address in TMEM 
Oxaf | 4 | w | TX SETIMAGEI I7 - even LOD address in TMEM 
31 24|23 16 1587 0 
bit(s) description 
24 RID 
21 ІМАСЕ ТҮРЕ 
0 | cached | 
1 | preloaded | 
18 CACHE HEIGHT 
O | unused/reserved 
] | unused/reserved 
2 | unused/reserved 
3 | 32kb 
4 | 128kb 
5 | 512kb 
6 | unused/reserved 
7 | unused/reserved 
15 CACHE WIDTH (must be equal to CACHE HEIGHT) 
0 TMEM, OFFSET (address in ТМЕМ > > 5) 
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0x90 | 4 | w | TX SETIMAGEA 10 - odd LOD address in TMEM 
0x91 | 4 | w | TX SETIMAGEA II - odd LOD address in TMEM 
0x92 | 4 | w | ТХ ЅЕТІМАСЕ2 12 - odd LOD address in TMEM 
0x93 | 4 | w | TX SETIMAGEA I3 - odd LOD address in TMEM 
0xb0 | 4 | w | TX SETIMAGEA 14 - odd LOD address in TMEM 
0хр1 | 4 | w | TX SETIMAGEA I5 - odd LOD address in TMEM 
0хр2 | 4 | w | TX SETIMAGEA I6 - odd LOD address in TMEM 
0xb3 | 4 | w | TX SETIMAGEA I7 - odd LOD address in TMEM 
31 24|23 16 1587 0 
bit(s) description 
24 RID 
18 CACHE HEIGHT 
0 | none (if odd LOD is unused) 
] | unused/reserved 
2 | unused/reserved 
3 | 32kb 
4 | 128kb 
5 | 512kb 
6 | unused/reserved 
7 | unused/reserved 
15 CACHE WIDTH (must be equal to CACHE HEIGTH) 
0 ТМЕМ. OFFSET - (address in TMEM > > 5) 
0x94 | 4 | м | TX ЗЕТІМАСЕЗ IO - Address of Texture in main memory 
0x95 | 4 | м | TX ЗЕТІМАСЕЗ П - Address of Texture in main memory 
0x96 | 4 | м | TX SETIMAGE3 12 - Address of Texture in main memory 
0x97 | 4 | w | TX ЗЕТІМАСЕЗ ІЗ - Address of Texture in main memory 
0хр4 | 4 | w | TX SETIMAGE? I4 - Address of Texture in main memory 
0xb5 | 4 | м | TX ЗЕТІМАСЕЗ I5 - Address of Texture in main memory 
Oxb6 | 4 | w | TX ЗЕТІМАСЕЗ I6 - Address of Texture in main memory 
0xb7 | 4 | w | TX SETIMAGE? I7 - Address of Texture in main memory 
31-.-24.]23 6 | 15: 1.8.7. 70 
bit(s) description 
24 RID 
0 IMAGE BASE (physical address > > 5) 
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0x98 | 4 | w | TX SETTLUT 0 
0x99 | 4 | w | TX SETILUT 1 
0х9а | 4 | w | TX SETTLUT 2 
0x9b | 4 | w | TX SETTLUT 3 
Oxb8 | 4 | w | TX SETTLUT 4 
0xb9 | 4 | w | TX SETTLUT 5 
Oxba | 4 | w | TX SETTLUT 6 
0хрр | 4 | w | TX SETTLUT 7 
31 24 |23 16 15 8 7 0 
bit(s) description 
24 RID 
10 FORMAT 

0 | IA8 

1 | RGB565 

2 | RGB5A3 

3 | reserved/unused 

0 TMEM_OFFSET (offset of TLUT from start of TMEM high bank > > 5) 

0х9с | 4 | м | ? 
0х9а | 4 | w |? 
0x90 4 | w | ? 
Ox9f | 4 | w |? 
0хрс | 4 | м |? 
0хра | 4 | м | ? 
Охре | 4 | м |? 
Oxbf | 4 | w | ? 


5 HARDWARE REGISTERS 


TEV_COLOR_ENV_0 
TEV COLOR ENV | 
TEV COLOR ENV 2 
TEV COLOR ENV 3 
TEV COLOR ENV 4 
TEV COLOR ENV 5 
TEV COLOR ENV 6 
TEV COLOR ENV 7 
TEV COLOR ENV 8 
TEV COLOR ENV 9 
TEV COLOR ENV A 
xd6 TEV COLOR ENV B 
xd8 TEV COLOR ENV C 
xda TEV COLOR ENV D 
xdc TEV COLOR ENV E 
TEV COLOR ENV F 


хс0 
хс2 
хс4 
xc6 
xc8 
xca 
хсс 
хсе 
ха0 
ха2 
ха4 


DIL Ol OL Of 2] OO] Of] OG] CO] GO] GC] Cf oso 


| Al BB Ay Ay aA] A] Ay | | AP Ap AP Ay A 


ааа <=] =] <] ааа ааа аа 


==> 


хае 


31 24 


№ 
w 


16 115870 


bit(s) description 

24 RID 
22 DEST 
20 SHIFT 
19 CLAMP 
18 SUB 

16 BIAS 

12 SELA 

8 SELB 

4 SELC 

0 SELD 


SELA - SELD Format: 


x0 | CC_CPREV 
xl | CC APREV 
x2 | CC CO 

x3 | CC A0 

ха | CC CI 

x5 | CC Al 

x6 | CC C2 

x7 | CC A2 

x8 | CC TEXC 
x9 | CC TEXA 
xA | CC RASC 
xB | CC RASA 
xC | CC ONE 

xD | CC HALF 
xE | CC KONST 
xF | CC ZERO 


0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
0 
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TEV_ALPHA_ENV_0 
ТЕУ_АГРНА_ЕМУ_1 
ТЕУ_АГРНА_ЕМУ_2 
TEV_ALPHA_ENV_3 
TEV_ALPHA_ENV_4 
TEV_ALPHA_ENV_5 
TEV_ALPHA_ENV_6 
TEV_ALPHA_ENV_7 
TEV_ALPHA_ENV_8 
TEV_ALPHA_ENV_9 
TEV_ALPHA_ENV_A 
xd7 TEV_ALPHA_ENV_B 
xd9 TEV_ALPHA_ENV_C 
xdb TEV_ALPHA_ENV_D 
xdd TEV_ALPHA_ENV_E 
xdf TEV_ALPHA_ENV_F 


xcl 
xc3 
хс5 
хс7 
хс9 
xcb 
xcd 
xcf 
ха1 
xd3 
xd5 


НС С Бал К Жо) Е еко sd C21. C» 
| Al a] || Ay | | | | | AP Ap AP Ay A 


ааа <=] =] <]<] <=) </ =<] <=] ааа а 


СӘ Маэ) 


(99) 
rA 
№ 
A 
N 
w 


16 115870 


bit(s) description 
24 RID 
22 DEST 
20 SHIFT 
19 CLAMP 
18 SUB 
16 BIAS 
13 SELA 
10 SELB 
7 SELC 
4 SELD 
2 TSWAP 
0 RSWAP 


SELA - SELD Format: 


CA_APREV 
CA_AO 
СА АІ 

СА А2 

СА ТЕХА 
СА КА5А 
СА KONST 
CA ZERO 


SYD] MY BY] GW] RO] о 


5 HARDWARE REGISTERS 


0xe0 | 4 | м | TEV_REGISTERL_0 
0хе2 | 4 | м | TEV_REGISTERL_1 
0хе4 | 4 | м | TEV_REGISTERL_2 
0xe6 | 4 | w | ТЕУ REGISTERL 3 
312 4 |23 .16 | 15--8-| 4 9 
bit(s) description 
24 RID 
23 TYPE 
[0 | Color(?) | 
| 1 | Constant (?) | 
12 A 
0 R 
0хе1 | 4 | м | ТЕУ REGISTERH 0 
0xe3 | 4 | м | TEV_REGISTERH_1 
0хе5 | 4 | м | TEV_REGISTERH_2 
0хе7 | 4 | w | ТЕУ REGISTERH 3 
31 24 |23 16 1587 0 
bit(s) description 
24 RID 
23 TYPE 
[0 | Color(?) | 
| 1 | Constant (?) | 
12 G 
0 B 
0x88 | 4 | w | Fog Range 
0x89 | 4]w 
0х8А | 4| w 
0x8B | 4| w 
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Oxec (guessed) | 4 | w | tev_range_adj_c 
31 24)23 1611587 0 
bit(s) description 
24 RID 
10 CENTER - Screen X Center for range Adjustment 
0 ENB - Range-Adjustment enable 
| 0 | TEV_ENB_DISABLE | 
| 1 | TEV_ENB_ENABLE | 
Oxed (guessed) | 4 | w | tev_range_adj_k 
31 24|23 16115 8 7 0 
bit(s) description 
24 RID 
0-11 т2К (u4.8) - specifies the range adjustment function 


range adjustment = sqr ( (x*x) + (k*k) ) /k 


Охее | 4 | м | ТЕУ РОС PARAM О0- "а" parameter of the screen to eye space conversion function 
31 24|23 16/|15 8 7 0 
bit(s) description 

24 RID 

19 A SIGN SHIFT 

11 A EXPN 

0 А MANT (signed 11e8) 
Oxef | 4 | w | TEV FOG PARAM 1 - the "b" parameter of the z screen to eye space conversion function 
3L -24!323- 16 | 15 8117.9 
bit(s) description 

24 RID 

0 B. MAG (unsigned 0.24) 


5 HARDWARE REGISTERS 


0хҒ0 | 4 


w | TEV FOG PARAM 2 - amount to pre-shift screen z 


23 164,15 8/7 0 


bit(s) description | 
24 RID | 
0-4 B_SHF - equivalent to the value of "Ъ" parameter’s exponent + 1 | 


The Z-Screen to Eyespace conversion is defined as: 


Ze = A / (B MAG - (Zs >> B_SHF)) 


0хЕ1 | 4 | w | TEV_FOG_PARAM 3 - fog type 
31 24 | 23 1611587 0 
bit(s) description 
24 RID 
21-23 FSEL 
0 | FSEL_OFF; No fog 
1 | reserved 
2 | FSEL_LIN; linear Fog 
3 | reserved 
4 | FSEL_EXP; Exponential Fog 
5 | FSEL_EX2; Exponential Squared Fog 
6 | FSEL_BXP; Backward Exp Fog 
7 | FSEL_BX2 Backward Exp Squared Fog 
20 PROJ 
0 | PERSP; Perspective projection | 
1 | ORTHO; Orthographic projection | 
19 C_SIGN (*) 
11 C_EXPN (*) 
0-10 C_MANT (*) 


(*) Specifies the amount to subtract from eye-space Z after range adjustment. 


Oxf2 | 4 


w | TEV_FOG_COLOR - Value of Fog Color 


23 16115870 


bit(s) description 
24 RID 
16 R 
8 G 
0 B 
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Oxf3 | 4 | м | TEV_ALPHAFUNC 
31 24 |23 16 15 8 7 0 
bit(s) description 
24 RID 
22 LOGIC 
0 | AND 
1 | OR 
2 | ХОК 
3 | XNOR 
19 ОРІ 
16 OPO 
8 Al 
0 AO 
Oxf4 w | ТЕУ 7 ЕМУ 0 
31 24|23 16 15 8 7 0 
bit(s) description | 
24 RID - 
0-23 ZOFF/BIAS - 
Oxf5 w | TEV_Z_ENV_1 
31 24|23 16 15 8 7 0 
bit(s) description 
24 RID 
2-3 OP 
О | disable 
1 | add 
2 | replace 
3 | unused/reserved 
0-1 TYPE/FORMAT 
0 | ug 
11016 
2 | u24 
3 | unused/reserved 


123 
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TEV_KSEL_0 
TEV_KSEL_1 
TEV_KSEL_2 
TEV KSEL 3 
TEV KSEL 4 
TEV KSEL 5 
TEV KSEL 6 
TEV KSEL 7 


| Al B BÉ | B ADR 


о|о|о|о|ој|ојо|о 
мм ххх |х рх 


ааа ааа 


© 
- 
№ 
ы 
№ 
[v 


16 15 8 


bit(s) description 

24 RID 

19 KASELI 

14 KCSELI 

9 KASELO 

4 KCSELO 

2 XGA 

0 XRB 


KCSEL - tev const color sel 
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со 


A 


N 


со 


A 


к-| =| Go] =| vj шо NI — 
oo 


с© 


о | N мы шо о = 


12 | KO 

13 | КІ 

14 | K2 

15 | K3 

16 | KO_R 
17 | KIR 
18 | К2 К 
19 | КЗК 
20 | КОС 
21 | КС 
22 | K2G 
23 | K3_G 
24 | KO_B 
25 | КІВ 
26 | К2 В 
27 | КЗ В 
28 | КОА 
29 | КГА 
30 | К2 А 
31 | КЗ А 


KASEL - tev const alpha sel 
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со 


A 


N 


со 


A 


к-| =| Go] =| vj шо NI — 
oo 


с© 


о | N мы шо о = 


w | SS_MASK - BP Mask Register 


24123 16 


15 


8 


7 


0 


description 


RID 


MASK (*) 


126 


(*) This Register can be used to limit to which bits of BP registers is actually written to. the mask is 


only valid for the next BP command, and will reset itself. 


Oxff 


4 


у |? 


5 HARDWARE REGISTERS 


5.11.2 


internal CP Registers 


Registerblock Base | Size of Registerblock | common access size 
0x20 0xa0 4 

Register description 
0x20 ? 
0x30 MATINDEX A - Texture Matrix Index 0-3 
0x40 MATINDEX B - Texture Matrix Index 4-7 
0x50 VCD_LO - Vertex Descriptor (VCD) low, format 0 
0x51 VCD ГО - Vertex Descriptor (VCD) low, format 1 
0x52 УС” ГО - Vertex Descriptor (VCD) low, format 2 
0x53 УСр LO - Vertex Descriptor (VCD) low, format 3 
0x54 VCD_LO - Vertex Descriptor (VCD) low, format 4 
0x55 VCD. LO - Vertex Descriptor (VCD) low, format 5 
0x56 VCD ГО - Vertex Descriptor (VCD) low, format 6 
0x57 VCD. LO - Vertex Descriptor (VCD) low, format 7 
0x60 VCD HI - Vertex Descriptor (VCD) high, format 0 
0x61 VCD HI - Vertex Descriptor (VCD) high, format 1 
0x62 VCD HI - Vertex Descriptor (VCD) high, format 2 
0x63 VCD HI - Vertex Descriptor (VCD) high, format 3 
0x64 VCD HI - Vertex Descriptor (VCD) high, format 4 
0x65 VCD HI - Vertex Descriptor (VCD) high, format 5 
0x66 VCD HI - Vertex Descriptor (VCD) high, format 6 
0x67 VCD HI - Vertex Descriptor (VCD) high, format 7 
0x70 VAT A - Vertex Attribute Table (VAT) group 0, format 0 
0x71 VAT_A - Vertex Attribute Table (VAT) group 0, format 1 
0x72 VAT_A - Vertex Attribute Table (VAT) group 0, format 2 
0x73 VAT_A - Vertex Attribute Table (VAT) group 0, format 3 
0x74 VAT_A - Vertex Attribute Table (VAT) group 0, format 4 
0x75 VAT_A - Vertex Attribute Table (VAT) group 0, format 5 
0x76 VAT_A - Vertex Attribute Table (VAT) group 0, format 6 
0x77 VAT А - Vertex Attribute Table (VAT) group 0, format 7 
0x80 УАТ B - Vertex Attribute Table (VAT) group 1, format 0 
0x81 УАТ B - Vertex Attribute Table (VAT) group 1, format 1 
0x82 УАТ В - Vertex Attribute Table (VAT) group 1, format 2 
0x83 УАТ B - Vertex Attribute Table (VAT) group 1, format 3 
0x84 УАТ B - Vertex Attribute Table (VAT) group 1, format 4 
0x85 УАТ B - Vertex Attribute Table (VAT) group 1, format 5 
0x86 УАТ B - Vertex Attribute Table (VAT) group 1, format 6 
0x87 УАТ B - Vertex Attribute Table (VAT) group 1, format 7 
0x90 УАТ C - Vertex Attribute Table (VAT) group 2, format 0 
0x91 УАТ C - Vertex Attribute Table (VAT) group 2, format 1 
0x92 УАТ C - Vertex Attribute Table (VAT) group 2, format 2 
0x93 VAT С- Vertex Attribute Table (VAT) group 2, format 3 
0x94 УАТ C - Vertex Attribute Table (VAT) group 2, format 4 
0x95 УАТ C - Vertex Attribute Table (VAT) group 2, format 5 
0x96 УАТ C - Vertex Attribute Table (VAT) group 2, format 6 
0x97 УАТ C - Vertex Attribute Table (VAT) group 2, format 7 


127 


5 HARDWARE REGISTERS 


Register description 
0хА0 ARRAY_BASE - vertices ptr 
0xal ARRAY BASE - normals ptr 
0xa2 ARRAY BASE - color 0 ptr 
0xa3 ARRAY BASE - color 1 ptr 
0xa4 ARRAY BASE - texture 0 coordinate ptr 
0xa5 ARRAY BASE - texture 1 coordinate ptr 
0xa6 ARRAY BASE - texture 2 coordinate ptr 
0xa7 ARRAY BASE - texture 3 coordinate ptr 
0xa8 ARRAY BASE - texture 4 coordinate ptr 
0xa9 ARRAY BASE - texture 5 coordinate ptr 
0xaa ARRAY BASE - texture 6 coordinate ptr 
Охар ARRAY BASE - texture 7 coordinate ptr 
0xac ARRAY BASE - IndexRegA - general purpose array 0 ptr 
0xad ARRAY BASE - IndexRegB - general purpose array 1 ptr 
0xae ARRAY BASE - IndexRegC - general purpose array 2 ptr 
Oxaf ARRAY BASE - IndexRegD - general purpose array 3 ptr 
0xBO ARRAY_STRIDE - size of vertices 
0хр1 ARRAY_STRIDE - size of normals 
0xb2 ARRAY STRIDE - size of colors 0 
0xb3 ARRAY, STRIDE - size of colors 1 
0xb4 ARRAY STRIDE - size of texture 0 coordinates 
0xb5 ARRAY STRIDE - size of texture 1 coordinates 
0xb6 ARRAY STRIDE - size of texture 2 coordinates 
0xb7 ARRAY STRIDE - size of texture 3 coordinates 
0xb8 ARRAY STRIDE - size of texture 4 coordinates 
0xb9 ARRAY STRIDE - size of texture 5 coordinates 
0xba ARRAY STRIDE - size of texture 6 coordinates 
Oxbb ARRAY_STRIDE - size of texture 7 coordinates 
0xbc ARRAY STRIDE - IndexRegA - general purpose array 0 stride 
0xbd ARRAY STRIDE - IndexRegB - general purpose array 1 stride 
0xbe ARRAY STRIDE - IndexRegC - general purpose array 2 stride 
Oxbf ARRAY_STRIDE - IndexRegD - general purpose array 3 stride 
0x20 | 4 |w |? 
0x30 | 4 | м | MATIDX REG А 
31 24|23 16/|15 8 7 0 
bit(s) description 
24 TEX3IDX - Index for Texture 3 matrix 
18 TEX2IDX - Index for Texture 2 matrix 
12 ТЕХ1ТОХ - Index for Texture 1 matrix 
6 TEXOIDX - Index for Texture 0 matrix 
0 POSIDX - Index for Position/Normal matrix 
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0x40 | 4 | w | MATIDX REG B 


31 24123 16 15 8/7 0 


bit(s) description 

18 TEX7IDX - Index for Texture 7 matrix 

12 TEX6IDX - Index for Texture 6 matrix 

6 TEX5IDX - Index for Texture 5 matrix 

0 TEX4IDX - Index for Texture 4 matrix 
0x50 | 4 | КЛУ | УС” LO - Vertex Descriptor low Format 0 
0x51 | 4 | R/W | УС” ТО Vertex Descriptor low Format 1 
0x52 | 4 | КЛУ | УС” LO - Vertex Descriptor low Format 2 
0x53 | 4 | R/W | VCD_LO - Vertex Descriptor low Format 3 
0x54 | 4 | R/W | VCD_LO - Vertex Descriptor low Format 4 
0x55 | 4 | R/W | VCD_LO - Vertex Descriptor low Format 5 
0x56 | 4 | R/W | VCD_LO - Vertex Descriptor low Format 6 
0x57 | 4 | R/W | VCD_LO - Vertex Descriptor low Format 7 


31 24123 16115 8/7 0 


bit(s) description 
17-31 unused 
15-16 COL1 - Colorl (Specular) 
13-14 COLO - Color0 (Diffused) 
11-12 NRM - Normal or Normal/Binormal/Tangent 
9-10 POS - Position 
8 T7MIDX 
f T6MIDX 
6 T5MIDX 
5 T4MIDX 
4 T3MIDX 
3 T2MIDX 
2 ТІМІрХ 
1 TOMIDX - Texture Coordinate 0 Matrix Index 
0 PMIDX - Position/Normal Matrix Index (*1) 
(*1) position and normal matrices are stored in 2 seperate areas of internal XF memory, 
but there is а one to one correspondence between normal and position index.If index 'A' 


is used for the position, then index 'A' needs to be used for the normal as well. 
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0x60 | 4 | R/W | VCD HI- Vertex Descriptor high Format 0 
0x61 | 4 | R/W | УС” НІ- Vertex Descriptor high Format 1 
0x62 | 4 | R/W | УС” НІ- Vertex Descriptor high Format 2 
0x63 | 4 | R/W | VCD_HI- Vertex Descriptor high Format 3 
0x64 | 4 | R/W | УС” НІ- Vertex Descriptor high Format 4 
0x65 | 4 | R/W | VCD HI- Vertex Descriptor high Format 5 
0x66 4 | R/W | VCD HI- Vertex Descriptor high Format 6 
0x67 | 4 | R/W | УС” HI- Vertex Descriptor high Format 7 
31 24 | 23 16115 8 7 0 
..tt 

bit(s) description 

16- unused 
14-15 TEX" - texture coordinate 7 
12-13 TEX6 - texture coordinate 6 
10-11 TEX5 - texture coordinate 5 

8-9 TEX4 - texture coordinate 4 

6-7 TEX3 - texture coordinate 3 

4-5 TEX2 - texture coordinate 2 

2-3 TEX1 - texture coordinate 1 

0-1 t | ТЕХО - texture coordinate 0 


vertex descriptor data 


value | Vertex/Color Pos/Tex Matrix Index 
0 no data present no data present 

1 direct direct 

2 18 - indirect/8 bit index n/a 

3 116 - indirect/16 bit index | n/a 
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0x70 | 4 | w | СР VAT REG A Format 0 
0x71 | 4 | w | СР VAT КЕСА- Format 1 
0x72 | 4 | w | СР VAT REG А - Format 2 
0x73 | 4 | w | СР VAT REG А - Format 3 
0x74 | 4 | w | СР VAT REG А - Format 4 
0x75 | 4 | w | СР VAT REG А - Format 5 
0x76 | 4 | w | СР VAT REG А - Format 6 
0x77 | 4 | w | СР VAT REG A Format 7 
31 24 |23 16 1587 0 


bit(s) description 
31 NORMALINDEX3 (*1) 
0 | single index per normal | 
1 | triple-index рег nine-normal | 
30 BYTEDEQUANT (should always be 1) 
0 | shift does not apply to u8/s8 components | 
1 | shift applies to u8/s8 components | 
25 TEXOSHFT 
22 TEXOFMT 
21 TEXOCNT 
18 COLIFMT (Specular) 
17 COLICNT (Specular) 
14 COLOFMT (Diffused) 
13 COLOCNT (Diffused) 
10 NRMFMT 
9 NRMCNT 
4 POSSHFT 
1 РОЗЕМТ 
0 POSCNT 


(*1) when nine-normals are selected in indirect mode, input will be treated as three 
staggered indices (one per triple biased by components size), into normal table (note: 
first index internally biased by 0, second by 1, third by 2) 
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Vertex Attribute Data Formats 


0x80 | 4 | w | СР VAT REG B Format 0 
0x81 | 4 | w | СР VAT REG. B Format 1 
0x82 | 4 | w | СР VAT REG. B Format 2 
0x83 | 4 | w | СР VAT REG. B Format 3 
0x84 | 4 | w | СР VAT REG. B Format 4 
0x85 | 4 | w | СР VAT REG B Format 5 
0x86 | 4 | w | СР VAT REG B Format 6 
0x87 | 4 | w | СР VAT REG. B Format 7 
31 24 |23 16 1587 0 
bit(s) description 

31 VCACHE_ENHANCE (must always be 1) 
28 TEX4FMT 

27 TEX4CNT 

22 TEX3SHFT 

19 TEX3FMT 

18 TEX3CNT 

13 TEX2SHFT 

10 TEX2FMT 

9 TEX2CNT 

4 TEXISHFT 

1 TEXIFMT 

0 TEXICNT 
0x90 4 | w | СР VAT REG C Format 0 
0x91 | 4 | w | СР VAT REG C Format 1 
0x92 | 4 | w | СР VAT REG C Format 2 
0x93 | 4 | w | СР VAT REG C Format 3 
0x94 | 4 | w | СР VAT REG C Format 4 
0x95 | 4 | № | СР VAT REG C Format 5 
0x96 4 | w | СР VAT REG C Format 6 
0x97 | 4 | w | СР VAT REG C Format 7 
31 24|23 16 15870 
bit(s) description 

27 TEX7SHFT 

24 ТЕХТЕМТ 

23 TEX7CNT 

18 TEX6SHFT 

15 TEX6FMT 

14 TEX6CNT 

9 TEX5SHFT 

6 TEX5FMT 

5 TEX5CNT 

0 TEXASHFT 
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CompCount 
value | coords normals | tex coords | colors 
0 two (x,y) three one (s) three (r,g,b) 
1 three (x,y,z) | nine two (s,t) four (r,g,b,a) 
CompSize 
value | coords | normals | colors 
0 18 п/а 16 bit rgb565 
1 s8 s8 24 bit rgb888 
2 ul6 n/a 32 bit rgb888x 
3 sl6 sl6 16 bit rgba4444 
4 #32 £32 24 bit rgba6666 
5 n/a n/a 32 bit rgba8888 
6 unused | unused unused 
7 unused | unused unused 
Shift 
coords normals colors 


location of decimal point | n/a (byte: 6, short: 14) | n/a 


This shift applies to all 516/016 components, and all 58/58 components when ByteDequant 

is asserted. 
0хА0 | 4 | w | ARRAY BASE 
0хА1 | 4 | w | ARRAY BASE 
0хА2 | 4 | w | ARRAY BASE 
0ХАЗ | 4 | w | ARRAY BASE 
0хА4 | 4 | w | ARRAY BASE 
0xA5 | 4 | w | ARRAY BASE 
OxA6 | 4 | w | ARRAY BASE 
OxA7 | 4 | w | ARRAY BASE 
0хА8 | 4 | w | ARRAY BASE 
0xA9 | 4 | w | ARRAY BASE 
OxAA | 4 | у | ARRAY BASE 
ОхАВ | 4 | w | ARRAY BASE 
OxAC | 4| w | ARRAY BASE 
OxXAD | 4 | w | ARRAY BASE 
OxAE | 4 | w | ARRAY BASE 
OxAF | 4 | w | ARRAY BASE 
31 24 |23 1611587 0 


bit(s) description 
26- unused 
0-25 array base addres in main memory 
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0xB0 | 4 | w | ARRAY STRIDE 
0xB1 | 4 | w | ARRAY STRIDE 
0xB2 | 4 | w | ARRAY STRIDE 
0xB3 | 4 | w | ARRAY_STRIDE 
0xB4 | 4 | w | ARRAY_STRIDE 
0xB5 | 4 | w | ARRAY_STRIDE 
0xB6 | 4 | w | ARRAY_STRIDE 
0xB7 | 4 | w | ARRAY_STRIDE 
0xB8 | 4 | w | ARRAY_STRIDE 
0xB9 | 4 | w | ARRAY_STRIDE 
0xBa | 4 | w | ARRAY_STRIDE 
0xBb | 4 | w | ARRAY_STRIDE 
OxBc | 4 | w | ARRAY_STRIDE 
OxBd | 4 | w | ARRAY_STRIDE 
0хВе | 4 | w | ARRAY_STRIDE 
OxBf | 4 | w | ARRAY_STRIDE 
31 24|23 16 1587 0 
bit(s) description 
8- unused 
0-7 аттау stride 


5.11.3 internal ХЕ Memory 
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Every register in the transform unit is mapped to a unique 32b address. All addresses are available to the 
xform register load command (command 0x30). 


The first block is formed by the matrix memory. Its address range is О to 1 К, but only 256 entries are 
used. This memory is organized in a 64 entry by four 32b words. Each word has a unique address and is 
a single precision floating point number. For block writes, the addresses auto increment. The memory is 
implemented in less than 4-32b rams, then it is possible that the memory writes to this block will require a 
minimum write size larger than | word. 


start end size | description 
0x0000 32 Matrix Ram word 0 
0x0001 | 0х00ҒҒ Matrix Ram word (п) 
0х0100 | 0x03ff | 0x300 | not used 
0 - position matrix (4*3) 


0ХЕ0 - (texture?) 


transform matrix (4*3) 


The second block of memory is the normal matrix memory. It is organized as 32 rows of 3 words. Each 
word has a unique address and is a single precision floating point number. Also, each word written is 32b, 
but only the 20 most significant bits are kept. For simplicity, the minimum granularity of writes will be 3 


words: 
start end size | description 
0x0400 | 0x0402 | 20 | Normal Ram words 0,1,2 
0x0403 | 0x045f Normal Ram word (n) 
0х0460 | 0х05ҒҒ not used 
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0x400 - normal transform matrix 


The third block of memory holds the dual texture transform matrices. The format is identical to the first 
block of matrix memory. There are also 64 rows of 4 words for these matrices. These matrices can only be 


(3*3) 


used for the dual transform of regular textures: 


start end size | description 
0x0500 32 | Matrix Ram word 0 
0х0501 | 0х05ҒҒ Matrix Ram word (n) 


0х5Ғ4 - dual textu 


The fourth block of memory is the light memory. This holds all the lighting information (light vectors, 
light parameters, etc.). Both global state and ambient state are stored in this memory. Each word written is 
32b, but only the 20 most significant bits are kept. Each row is 3 words wide. Minimum word write size is 


re transform matrix 


(4*3) 


3 words. 
start end size description 
0x0600 reserved 
0x0601 reserved 
0x0602 reserved 
0x0603 32 bit | Light0 - RGBA 
0x0604 20 bit | LightOAO - cos atten. А-0 
0x0605 20 bit | LightOA1 - cos atten. А-1 
0x0606 20 bit | Light0A2 - cos atten. А-2 
0x0607 20 bit | LightOKO - dist atten. А-0 
0x0608 20 bit | LightOK1 - dist atten. А-1 
0x0609 20 bit | LightOK2 - dist atten. А-2 
0x060a 20 bit | LightOLpx - x light pos, or inf ldir x 
0x060b 20 bit | LightOLpy - y light pos, or inf ldir y 
0x060c 20 bit | LightOLpz - z light pos, or inf ldir z 
0x060d 20 bit | LightODx/Hx - light dir x, or 1/2 angle x 
0x060e 20 bit | LightODy/Hy - light dir y, or 1/2 angle y 
0х060Ғ 20 bit | LightODz/Hz - light dir z, or 1/2 angle 2 
0х0610 | 0х067Е Light(n)data - see LightO data 
0x0680 | 0х07ҒҒ not used 
5.11.4 internal XF Registers 


Registerblock Base 


Size of Registerblock 


common access size 


0x1000 


0x54 4 
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ScaleY - Viewport Scale Y 


Scale Z - Viewport Scale Z 


OffsetX - Viewport Offset X 


OffsetY - Viewport Offset Y 


OffsetZ - Viewport Offset Z 


ProjectionA - A parameter in projection equations 


ProjectionB - B parameter in projection equations 


Register description 
0x1000 Error (=0x3f) 
0x1001 Diagnostics 
0x1002 StateO - Internal State Register 0 
0x1003 Statel - Internal State Register 1 
0x1004 Xf clock - Enables Power Saving Mode 
0x1005 ClipDisable - clip mode (20) 
0x1006 Рег - Performance monitor selects (20) 
0x1007 Perf1 - Xform target performance register 
0x1008 InVertexSpec - INVTXSPEC - (20x01) 
0x1009 NumColors - NUMCOLORS - (20x00) 
0x100a AmbientO - chan Ambient color 0 (20x00) 
0x100b Ambient1- chan Ambient color 1 (20x00) 
0x100c MaterialO - chan Material ID 0 (=Oxffffffff) 
0x100d Materiall - chan Material ID 1 (=Oxffffffff) 
0x100e COLOROCNTRL (=0x0401) 
0x100f COLORICNTRL (=0x0401) 
0x1010 ALPHAOCNTRL (=0x0401) 
0x1011 ALPHAICNTRL (=0x0401) 
0х1012 DualTexTrans - (=0x01) 
0x1013 ? 
0х1014 7? 
0х1015 ? 
0х1016 ? 
0х1017 ? 
0x1018 MatrixIndex0 - MATINDEX А 
0x1019 MatrixIndex1 - MATINDEX B 
0x101a ScaleX - Viewport Scale X 
10 
10 
10 
10 
10 
10 


0x1022 ProjectionC - C parameter in projection equations 
0x1023 ProjectionD - D parameter in projection equations 
0x1024 ProjectionE - E parameter in projection equations 
0x1025 ProjectionF - F parameter in projection equations 
0x1026 ProjectOrtho 
Register description 
0x103f NUMTEX - Number of active Textures 
0x1040 TEXO 
0x1041 TEXI 
0x1042 TEX2 
0x1043 TEX3 
0x1044 TEX4 
0x1045 ТЕХ5 
0х1046 TEX6 
0x1047 TEX7 
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Register description 

0x1050 DUALTEX0 

0x1051 DUALTEXI 

0x1052 DUALTEX2 

0x1053 DUALTEX3 

0x1054 DUALTEX4 

0x1055 DUALTEX5 

0x1056 DUALTEX6 

0x1057 DUALTEX7 

0х1000 4 | w | Error 

0х1001 | 4 | w | Diagnostics 

0х1002 | 4 | w | State 0 - Internal State Register 0 | 
0х1003 | 4 | w | State 1 - Internal State Register 1 | 
0x1004 | 4 | w | Xf clock 

31 24|23 16115 8 7 0 

bit(s) description 

0 | 0 | no power saving when idle | 
[1 | enable Power saving when idle | 

0х1005 | 4 | w | ClipDisable 

31 24|23 1611587 0 

bit(s) description 

2 when set, disable cpoly clipping acceleration (default==0) 

1 when set, disable trivial rejection (default==0) 

0 when set, disable clipping detection (default==0) 
0х1006 | 4 | w | PerfO - Performance monitor selects | 
0х1007 | 4 | м | Perfl - Xform target performance Register | 
31. :24:| 23% 6) 15. 8) O 
bit(s) description 

0-6 Xform internal target performance (Cycles per Vertex) 
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0x1008 | 4 | w | INVTXSPEC 


31 24123 16|15 8/7 0 


bit(s) description 
4-7 HOST TEXTURES - number of host supplied texture coordinates 
0 no host supplied textures | 
1 1 host supplied texture pair (SO, TO) | 
2-8 | 2-8 host supplied texturepairs | 
9-15 | reserved/unused | 
2-3 HOST_NORMAL - host supplied normal 
0 | no host supplied normal 
1 | host supplied normal 
2 | host supplied normal and binormals 
0-1 HOST COLORS - host supplied color0 usage 
0 | no host supplied color information 
1 | host supplied color 0 
2 | host supplied color 0 and color 1 
0х1009 | 4 | м | NUMCOLORS 
31 24123 16/|15 8 7 0 
value description 
0 No colors 
1 One color - Xform supplies 1 color (host supplied or computed) 
2 Two colors - Xform supplies 2 colors (host supplied or computed) 
Selects the number of output colors 


0х100а | 4 | № | XF_AMBIENTO - Ambient color 0 specifications | 
31 24|23 16 15817 0 
bit(s) description 

24 RED 

16 GREEN 

8 BLUE 

0 ALPHA 
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0x100b | 4 | w | ХЕ AMBIENTI - Ambient color 1 specifications 
Зе: |5225 LG. E еуел 
bit(s) description 
24 RED 
16 GREEN 
8 BLUE 
0 ALPHA 
0х100с | 4 | w | XF_MATERIALO - global colorO material specification 
31 24|23 16 15870 
bit(s) description 
24 RED 
16 GREEN 
8 BLUE 
0 ALPHA 
0x100d | 4 | w | XF_MATERIAL1 - global color! material specification 
3L 24") 23- 16.15.87 a TO 
bit(s) description 
24 RED 
16 GREEN 
8 BLUE 
0 ALPHA 
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0х100е | 4 | м | COLOROCNTRL 
31 24 |23 16115 8 7 0 
bit(s) description 
14 LIGHT? - Light 7 is source 
0 | Do not use Light 
1 | Use light 
13 LIGHT6 - Light6 is source 
0 | Do not use Light 
1 | Use light 
12 LIGHTS - Light5 is source 
0 | Do not use Light 
1 | Use light 
11 LIGHT4 - Light4 is source 
0 | Do not use Light 
1 | Use light 
10 ATTENSELECT - Attenuation Select function 
0 | Select specular (N.H) attenuation 
1 | Select diffuse spotlight (L.Ldir) attenuation | 
9 АТТЕМЕМАВЬЕ - Attenuation Enable function 
0 | Select 1.0 | 
1 | Select Attenuation fraction | 
7-8 DIFFUSEATTEN - Diffuse Attenuation function 
00 | Select 1.0 
01 | Select N.L, signed 
10 | Select N.L clamped to [0,1.0] 
11 
6 AMBIENT. SRC - Ambient source 
0 | Use register AmbientO register | 
1 | Use CP supplied vertex color 0 | 
5 LIGHT3 - Light3 is source 
0 | Do not use light 
1 | Use light 
4 LIGHT2 - Light2 is source 
0 | Do not use light 
1 | Use light 
3 LIGHT1 - Lightl is source 
0 | Do not use light 
1 | Use light 
2 LIGHTO - LightO is source 
0 | Do not use light 
1 | Use light 
1 LIGHTFUNC - Color0 Light Function 
O[UselO | 
1 | Use IllumO | 
0 ATERIAL SRC - Color0 Material source 
0 | Use register (Material 0) | 
1 | Use CP supplied Vertex color 0 | 
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0х100Ё | 4 | w | COLORICNTRL 
31 24123 16115 8 7 0 
bit(s) description 
14 LIGHT? - Light 7 is source 
0 | Do not use Light 
1 | Use light 
13 LIGHT6 - Light6 is source 
0 | Do not use Light 
1 | Use light 
12 LIGHTS - Light5 is source 
0 | Do not use Light 
1 | Use light 
11 LIGHT4 - Light4 is source 
0 | Do not use Light 
1 | Use light 
10 ATTENSELECT - Attenuation Select function 
0 | Select specular (N.H) attenuation 
1 | Select diffuse spotlight (L.Ldir) attenuation | 
9 АТТЕМЕМАВЬЕ - Attenuation Enable function 
0 | Select 1.0 | 
1 | Select Attenuation fraction | 
7-8 DIFFUSEATTEN - Diffuse Attenuation function 
00 | Select 1.0 
01 | Select N.L, signed 
10 | Select N.L clamped to [0,1.0] 
11 
6 AMBIENT_SRC - Ambient source 
0 | Use register Ambient! register | 
1 | Use CP supplied vertex color 1 | 
5 LIGHT3 - Light3 is source 
0 | Do not use light 
1 | Use light 
4 LIGHT2 - Light2 is source 
0 | Do not use light 
1 | Use light 
3 LIGHT1 - Lightl is source 
0 | Do not use light 
1 | Use light 
2 LIGHTO - LightO is source 
0 | Do not use light 
1 | Use light 
1 LIGHTFUNC - Color! Light Function 
0 | Usel.O | 
1 | Use Illum] | 
0 ATERIAL SRC - Color] Material source 
0 | Use register (Material 1) | 
1 | Use СР supplied Vertex color 1 | 
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0х1010 | 4 | w | ALPHAOCNTRL 
31 24) 23 16115 8 7 0 
bit(s) description 
14 LIGHT? - Light 7 alpha is source 
0 | Do not use Light 
1 | Use light 
13 LIGHT6 - Light6 alpha is source 
0 | Do not use Light 
1 | Use light 
12 LIGHTS - Light5 alpha is source 
0 | Do not use Light 
1 | Use light 
11 LIGHT4 - Light4 alpha is source 
0 | Do not use Light 
1 | Use light 
10 ATTENSELECT - Attenuation Select function 
0 | Select specular (N.H) attenuation 
1 | Select diffuse spotlight (L.Ldir) attenuation | 
9 ATTENENABLE - Attenuation Enable function 
0 | Select 1.0 | 
1 | Select Attenuation fraction | 
7-8 DIFFUSEATTEN - Diffuse Attenuation function 
00 | Select 1.0 
01 | Select N.L, signed 
10 | Select N.L clamped to [0,1.0] 
11 
6 AMBIENT_SRC - Ambient source 
0 | Use register AmbientO alpha register | 
1 | Use CP supplied vertex color 0 alpha | 
5 LIGHT3 - Light3 alpha is source 
0 | Do not use light 
1 | Use light 
4 LIGHT2 - Light2 alpha is source 
0 | Do not use light 
1 | Use light 
3 LIGHT1 - Light! alpha is source 
0 | Do not use light 
1 | Use light 
2 LIGHTO - LightO alpha is source 
0 | Do not use light 
1 | Use light 
1 LIGHTFUNC - Color0 alpha Light Function 
0 | Usel.O | 
1 | Use IllumO | 
0 ATERIAL SRC - Color0 alpha Material source 
0 | Use register (Material 0 alpha) | 
1 | Use CP supplied Vertex color 0 alpha | 
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0x1011 | 4 | w | ALPHAICNTRL 
31 24 | 23 16115 8 7 0 
bit(s) description 
14 LIGHT? - Light 7 alpha is source 
0 | Do not use Light 
1 | Use light 
13 LIGHT6 - Light6 alpha is source 
0 | Do not use Light 
1 | Use light 
12 LIGHTS - Light5 alpha is source 
0 | Do not use Light 
1 | Use light 
11 LIGHT4 - Light4 alpha is source 
0 | Do not use Light 
1 | Use light 
10 ATTENSELECT - Attenuation Select function 
0 | Select specular (N.H) attenuation 
1 | Select diffuse spotlight (L.Ldir) attenuation | 
9 ATTENENABLE - Attenuation Enable function 
0 | Select 1.0 | 
1 | Select Attenuation fraction | 
7-8 DIFFUSEATTEN - Diffuse Attenuation function 
00 | Select 1.0 
01 | Select N.L, signed 
10 | Select N.L clamped to [0,2.0] 
11 
6 AMBIENT_SRC - Ambient source 
0 | Use register Ambient! alpha register | 
1 | Use CP supplied vertex color 1 alpha | 
5 LIGHT3 - Light3 alpha is source 
0 | Do not use light 
1 | Use light 
4 LIGHT2 - Light2 alpha is source 
0 | Do not use light 
1 | Use light 
3 LIGHT1 - Light! alpha is source 
0 | Do not use light 
1 | Use light 
2 LIGHTO - LightO alpha is source 
0 | Do not use light 
1 | Use light 
1 LIGHTFUNC - Color0 alpha Light Function 
0 | Usel.O | 
1 | Use IllumO | 
0 ATERIAL SRC - Color0 alpha Material source 
0 | Use register (Material 0 alpha) | 
1 | Use CP supplied Vertex color 0 alpha | 


143 


5 HARDWARE REGISTERS 


0x1012 | 4 | w | DualTexTrans 
31 24 | 23 16 15 8 
bit(s) description 

0 | 0 | disable dual texture transform feature 
| 1 | enable dual transform for all texture coordinates | 

0х1013 | 4 | w |? 

0х1014 | 4| w | ? 

0х1015 |4 | w |? 

0х1016 4 ^ м |? 

0х1017 | 4| w | ? 
0x1018 | 4 | м | MatrixIndexO 
31 24 | 23 16 15 8 
bit(s) description 
24-29 Tex3 matrix index 
23-18 Tex2 matrix index 
12-17 Tex1 matrix index 

6-11 Тех0 matrix index 

0-5 Geometry matrix index 
0х1019 | 4 | м | MatrixIndex1 
З 24 |28: V6) 15. 8 
bit(s) description 
18-23 Tex7 matrix index 
12-17 Tex6 matrix index 

6-11 Тех5 matrix index 

0-5 Tex4 matrix index 
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0х101А 
0x101B 
0x101C 
0x101D 
0х101Е 
0х101Е 


ыыы AL A] A 


== === 


Viewport 
Viewport 
Viewport 
Viewport 
Viewport 
Viewport 


Viewport Matrix 


description 


0х101А 


£32 


wd/2 


0x101B 


£32 


-ht/2 


0x101C 


f32 


ZMAX * (farZ - nearZ) 


0x101D 


£32 


xOrig + wd / 2 + 342 


0х101Е 


£32 


yOrig + ht/2 + 342 


0х101Е 


£32 


ZMAX * farZ 


ZMAX is 16777215.0 (maximum 24-bit Z buffer value, or ’infinite’ ) 


0x1020 
0x1021 
0x1022 
0x1023 
0x1024 
0x1025 


| | | A] A] A 


== === 


Projection Matrix 
Projection Matrix 
Projection Matrix 
Projection Matrix 
Projection Matrix 
Projection Matrix 


Projection Matrix 


orthogonal | perspective 
0x1020 | f32 | 2.0/(т-1) (1.0f / tanf(fovy * 0.5F)) / aspect 
0x1021 | f32 | -(r-D / (r-D | 0 
0x1022 | f32 | 2.0 / (t-b) (1.0f / tanf(fovy * 0.5F)) 
0x1023 | #32 | -(t+b)/(t-b) | 0 
0x1024 | f32 | -1.0/(f-n) -n * 1.0f / (Ёп) 
0x1025 | #32 | -(f)(£-n) -(f*n) * 1.0f / (f-n) 
0x1026 [ 4 | w | ProjectOrtho | 
31 24|23 16/|15 8 7 0 
bit(s) description 


If set selects orthographic otherwise non-orthographic (Zh or 1.0 select) 


note: regs 0x1027-0x103e skipped (all unknown) 


0x103f 


4 


w 


NUMTEX - Numter of active Textures 
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x1040 
х1041 
х1042 
х1043 
х1044 
х1045 
х1046 
х1047 


о|о|о|ојојојо|о 


ыыы B | Ay Ay A 


ааа ааа 


TEXO 
TEXI 
TEX2 
TEX3 
TEX4 
ТЕХ5 
TEX6 
TEX7 


31 24 


№ 
(99) 


16 115870 
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bit(s) 


description 


15-17 


EMBOSS_LIGHT - Bump mapping source light (*1) 


12-14 


EMBOSS_SOURCE - bump mapping source texture (*2) 


7-11 


SOURCE_ROW - regular texture source row (*3) 


GEOM_INROW - 


NORMAL INROW - 


COLORS INROW - 


BINORMAL T INROW - 


BINORMAL B INROW - 


TEXO INROW - 


TEX1_INROW - 


TEX2 INROW - 


TEX3 INROW - 


TEX4 INROW - 


TEX5 INROW - 


TEX6 INROW - 


TEX7 INROW - 


њо [оо | со ooc|-ojtu BY] W] N | о 


4-6 


TEXG 


0 


EN_TYPE 


REGULAR - Regular transformation (transform incoming data) 


1 


EMBOSS MAP - texgen bump mapping 


2 


COLOR, STRGBCO - Color texgen: (s,t)=(1,g:b) (g and b are concatenated), color 0 


3 


чә 


COLOR, STRGBCI - Color texgen: (s,t)=(1,g:b) (g and b are concatenated), color 1 
reserved/unused 


0 


INPUT_FORM - format of source input data for regular textures 
АВ11 - (A, B, 1.0, 1.0) (used for regular texture source) 


1 


PROJ. 


0 


АВСІ - (А, В, C, 1.0) (used for geometry or normal source) | 


ECTION 


ST - (s,t): texmul is 2x4 


1 


STQ - (s,t,q): texmul is 3x4 | 


reseved/unused 


(*1) n: use light #n for bump map direction source (10 to 17) 
(*2) n: use regular transformed tex(n) for bump mapping source 


(*3) Specifies location of incoming textures in vertex (row specific) (1.е.: geometry is row0, normal is 
rowl, еіс... ) for regular transformations 
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note: regs 0x1048-104f skipped (all unknown) 
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0х1050 | 4 | м | DUALTEXO 
0х1051 | 4 | w | DUALTEXI 
0x1052 | 4 | w | DUALTEX2 
0x1053 | 4 | w | DUALTEX3 
31 24|23 16 15870 
bit(s) description 
8 NORMAL_ENABLE - specifies if texture coordinate should be normalized before send transform. 
6-7 unused 
0-5 DUALMTX - base row of the dual transform matrix for regular texture coordinateO (63 max, simelar to 0х1018/0х1 


5.11.5 GP packet description 


The first thing in a GP Packet is the command type (8 bit).Next follows actual primitive data. It may vary 


on each opcode type. 


5.11.5.1 Command Type 


5.11.5.1.1 opcodes 


J 0 
0000 Оууу 
bit(s) description | 
о | Opcode | 
у | Vertex Attribute Table Index (VAT) | 
opcode | Description 
0x00 | МОР - No Operation 
0x08 | Load CP REG 
0x10 Load XF REG 
0x20 Load INDX A 
0x28 | Load INDX B 
0x30 Load INDX C 
0x38 | Load INDX D 
0x40 | CALL DL - Call Displaylist 
0x48 Invalidate Vertex Cache 
0x61 Load BP REG (SU, ByPassCmd) 
0x80 QUADS - Draw Quads (*) 
0x90 TRIANGLES - Draw Triangles (*) 
0x98 | TRIANGLESTRIP - Draw Triangle Strip (*) 
0хА0 TRIANGLEFAN - Draw Triangle Fan (*) 
0xA8 LINES - Draw Lines (*) 
0хВ0 LINESTRIP - Draw Line Strip (*) 
0хВ8 POINTS - Draw Points (*) 


(*) all draw opcodes must be Or-ed with used VAT index (0...7) 
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| 8 bits 16 bits n 


pare: Drawing Commands | opcode | number of vertices | vertex data 


Vertex data may be in one of many formats. The VCD tells wether data for a component exists (and 
if yes, if it is direct or indexed) and the VAT tells the actual format of the respective component. Each 
individual component may or may not exist, but the order is fixed as follows: 
1. PNMTXIDX - Position/Normal Matrix Index 
2. TEXOMTXIDX - Texture 0 Matrix Index 
3. TEXIMTXIDX - Texture 1 Matrix Index 
4. TEX2MTXIDX - Texture 2 Matrix Index 
5. TEX3MTXIDX - Texture 3 Matrix Index 
6. TEXAMTXIDX - Texture 4 Matrix Index 
7. TEXSMTXIDX - Texture 5 Matrix Index 
8. TEX6MTXIDX - Texture 6 Matrix Index 
9. TEX7MTXIDX - Texture 7 Matrix Index 
10. POS - Position Vector 
11. NRM - Normal or NBT - Binormal vector (T, B) 
12. CLRO - Color0 (Diffused) 
13. CLRI - Color! (Specular) 
14. TEXO - Texture 0 data 
15. TEXI - Texture 1 data 
16. TEX2 - Texture 2 data 
17. TEX3 - Texture 3 data 
18. TEXA - Texture 4 data 
19. ТЕХ5 - Texture 5 data 
20. TEX6 - Texture 6 data 
21. TEX7 - Texture 7 data 


Notice that the Position/Normal and Texture Matrix Indices are different from the other data in that they 
are 8 bit and must always be sent as direct data. 


5.11.5.2.1 Quads draws a series of non planar quads, using v0,v1,v2,v3 then v4,v5,v6,v7 and so on. 
(the quad is actually drawn using 2 triangles so the 4 vertices do not have to be coplanar). The minimum 
number of vertices is 4. 


5.11.5.2.2 Triangles draws a series of triangles, from vO,v1,v2 then v3,v4,v5 and so оп. The number 
of vertices should be a multiple of 3 
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5.11.5.2.3 Trianglestrip draws a series of triangles, from ү0,у1,у2 then v1,v3,v2, then v2,v3,v4 amd 
so on. The number of vertices must be at least 3. 


5.11.5.2.4 TriangleFan draws a series of triangles, from vO,v1,v2 then v0,v2,v3 and so on. The number 
of vertices must be at least 3. 


5.11.5.2.5 Lines draws a series of unconnected lines, from vO to v1, then from v2 to v3 and so on. The 
number of vertices should be a multiple of 2 


5.11.5.2.6 Linestrip draws a series of connected lines, from vO to v1, then from v1 to v2 and so on. If 
n vertices are drawn, n-1 lines are drawn 


5.11.5.2.7 Points draws a Point at each of the n vertices 


5.11.5.3 NOP - No Operation Use it to pad primitive data to 32-byte boundaries and to terminate a 
display list. 


5.11.5.4 CALL DL - Call Display List used to call one display list from another. 


8 bits 
7 0 
0100 0000 
opcode == 0x40 
32 bits 
31 24 | 23 16 | 15 8 | 7 0 
0000 000. ато ШЕКП 
list address 
32 bits 
31 24 | 23 16 | 15 8 | 7 0 
0000 000. 


list size in bytes (32 bit words?) 


8 bits 
opcode == 0x48 


5.11.5.5 Invalidate Vertex Cache 


bit bit 24 bit 
5.11.5.6 BP command (Bypass Raster State Registers) oul pis 2 


opcode == 0x61 | reg. addr. | reg. value 


5.11.5.7 CP command (Command Processor Registers) BOIS EDS SEDIS 


opcode == 0x08 | reg. addr. | reg. value 
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5.11.5.8 ХЕ command (Transform Unit Registers) 


note : "length" is limited to 16. 


5.11.5.9 Indexed XF command 


note : "length" is limited to 16. 
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8 bits 16 bits 16 bits | 32 bits * length 
opcode == 0x10 | length - 1 | 1st addr. reg. value(s) 
8 bits 16 bits 4 bits 12 bits 
opcode | index value | length-1 | 1st address 


There are 4 different XF index units, which are typically used as follows: A: pos. mtx's B: nrm. mtx’s C: 


tex. mtx's D: light obj's. 


6 EXCEPTION AND INTERRUPT PROCESSING 


6 Exception and Interrupt Processing 


6.1 Hardware Exception Sources 


Handler Start | Exception 
0x80000100 | System Reset Interrupt 
0x80000200 | Machine Check Interrupt 
0x80000300 | DSI Interrupt 
0x80000400 | ISI Interrupt 
0x80000500 | External Interrupt 
0x80000600 | Alignment Interrupt 
0x80000700 | Program Interrupt 
0x80000800 | FP unavailable Interrupt 
0x80000900 | Decrementer Interrupt 
0x80000C00 | System Call Interrupt 
0x80000d00 | Trace Interrupt 
0х80000Ғ00 | Performance Monitor Interrupt 
0x80001300 | IABR Interrupt 
0x80001700 | Thermal Interrupt 


6.1.1 System Reset Interrupt 


Triggered at a system reset 


6.1.2 Machine Check Interrupt 
6.1.3 DSI Interrupt 


Triggered if an attempt to store or read data from/to an illegal address was made 


6.1.4 ISI Interrupt 


Triggered if an attempt to fetch an instruction from an illegal address was made. 


6.1.5 External Interrupt 


14 sources, triggered by external chips (you may look at it as the traditional IRQ). 


6.1.5.1 Setup 


> set corresponding bit(s) in PI Interrupt Mask Register (0xcc003004) 


> enable external Interrupts in the Machine State Register 
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6.1.5.2 Handling 


> check PI Interrupt Cause Register (0xcc003000) for flags 
> acknowledge by setting corresponding bits in PI Interrupt Cause Register (0xcc003000) 


> handle different interrupt sources 


bit Description 

13 | НӘР High Speed Port 
12 | DEBUG External Debugger 
11 | СР Command FIFO 


10 | PE FINISH | Frame is Ready 


9 | PETOKEN | Token Assertion in Command List 
8 | VI Video Interface 

7 | MEM Memory Interface 

6 | DSP DSP 

5 | А Audio Streaming 

4 | ЕХІ EXI 

3 | SI Serial 

2 | DI DVD 

1 RSW Reset Switch 

0 | ERROR GP runtime error 


6.1.6 Alignment Interrupt 
6.1.7 Program Interrupt 


Triggered if the instruction that was about to execute is invalid. 


6.1.8 ЕР unavailable Interrupt 
6.1.9 Decrementer Interrupt 


Triggered by an underflow of the decrementer register. 


6.1.10 System Call Interrupt 


Triggered when the PowerPC instruction ’sc’ is executed. 


6.1.11 Trace Interrupt 
6.1.12 Performance Monitor Interrupt 
6.1.13 IABR Interrupt 


6.1.14 Thermal Interrupt 


6.2 External Interrupt Sources 
6.2.1 НР - High Speed Port 


3 Sources 
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6.2.1.1 TX Mailbox Interrupt 


6.2.1.2 RX Mailbox Interrupt 


6.2.1.3 ID Interrupt 


6.2.2 Debug 


1 Source 


6.2.3 CP - Command Processor 


2 Sources (read/write pointer watermark over- and underflow) check bit 0 and bit 1 of 0xcc000000 


6.2.3.4 FIFO underflow 


6.2.3.1.1 setup 


> setup CP FIFO low watermark 


> set bit 1 of CP interrupt status register (0xcc000002) to enable 


6.2.3.1.2 handling 


> clear bit 3 of CP interrupt status register (0xcc000002) to acknowledge 


6.2.3.2 FIFO overflow 


6.2.3.2.1 setup 


> setup CP FIFO high watermark 


> set bit 0 of CP interrupt status register (0xcc000002) to enable 


6.2.3.2.2 handling 


> clear bit 2 of CP interrupt status register (0xcc000002) to acknowledge 


6.2.4 PE - Pixel Engine Finished 


1 Source (Frame finished) 


6.2.41 setup 


> set bit 1 in PE Interrupt status register (0xcc001000a) 
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6.2.4.2 handling 


> set bit 3 in PE Interrupt status register (0xcc001000a) to acknowledge the interrupt 


6.2.5 PE - Pixel Engine Token 


1 Source (Token in GP Command List) 


6.2.5.1 setup 


> set bit 0 in PE Interrupt status register (0xcc001000a) 


6.2.5.2 handling 
> check PE Token Register (0xCC00000E) for the token that triggered the interrupt. 


> set bit 2 in PE Interrupt status register (0xcc001000a) to acknowledge the interrupt 


6.2.6 VI - Video Interface 


4 Sources, check (0xcc002030) (0xcc002034) (0xcc002038) (0xcc00203c) for flags 


6.2.6.1 Setup 


D- setup desired position of the interrupt 


154 


> setenable bit in Display Interrupt Register (0xcc002030) (0xcc002034) (0xcc002038) (0хсс00203с) 


6.2.6.2 Handling 


> clear Status bit in Display Interrupt Register (0xcc002030) (0xcc002034) (0xcc002038) (0xcc00203c) 


to acknowledge the interrupt. 


6.2.7 Memory Interface 


4 sources (4 regions of memory can be protected independently) 


6.2.7.1 protection fault 


6.2.7.1.1 Setup 


> clear (0xCC004020) 
[> setup the regions in (0xCC004000)(0xCC004004)(0xCC004008) (0xCC00400c) 
> setup type of protection in (0xCC004010) 


> enable protecting of regions in irq mask (0xCC00401c) 
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6.2.7.1.2 Handling 


> clear (0xCC004020) 
> read status bits from (0хСС00401е) to check what region triggered the protection fault 
> set status bits in (0xCC00401e) to acknowledge the interrupt 


D- read the address that triggered the protection fault from (0xCC004022) and (0xCC004024) 


6.2.8 DSP Interface 


3 Sources, check (0xcc00500a) for flags 


6.2.8.1 Audio DMA finished asserted when audio DMA transfer has been completed. 


6.2.8.1.1 Setup 


> set bit 4 of DSP Control Register (0xcc00500a) 


6.2.8.1.2 Handling 


> set bit 3 of DSP Control Register (0xcc00500a) to acknowledge the interrupt. 


6.2.8.2 ARAM transfer complete asserted when a transfer from/to auxiliary ram has been completed. 


6.2.8.3 DSP 


6.2.9 Audio Streaming Interface 


1 Source, check (0xcc006c00) for flag. asserted based on the disk streaming sample counter. 


6.2.10 EXI 


3 Sources each EXI Channel (TCINT,EXTINT,EXIIRQ), making 9 total, check (0xcc006800) (0xcc006814) 
(0xcc006828) for flags. 


6.2.10.1 DMA Transfer finished (TCINT channel 0, channel 1) 


6.2.10.2 Ethernet Adapter (ЕХПКО channel 2) 


6.2.10.2.1 setup 
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6.2.10.2.2 handling 


> check command register 3 (irq status) for the exact source (MX chip, killing irq,cmd error, chal- 
lenge/response request, challange/response status) 


> if from MX chip, check register 8 and 9 for the exact cause 


6.2.10.3 Memory Card removed (EXTINT channel 0, channel 1) 


6.2.10.3.1 setup 


6.2.10.3.2 handling 


> To check whether the device has been inserted or removed, check the EXICPR[EXT] bit. 


6.2.11 Serial Interface 
6.2.12 DVD Interface 


4 Sources (Break Complete, DMA finished, Device Error, Cover state changed), check (0xcc006000)(0xcc006004) 
for flags. 


6.2.12.1 Break Complete 


6.2.12.2 DMA finished 


6.2.12.3 Device Error 


6.2.12.4 Cover State changed 


6.2.13 Reset Button 


1 Source (Reset Button pressed) 


6.2.13.1 setup 


> no further setup required 


6.2.13.2 handling 


> nothing special required, its however recommended to clear the PI Interrupt Mask to avoid multiple 
interrupts. 


6.2.14 Error 


1 Source (GP runtime error) 
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7 Video Processing 


7.1 Used VI terms 


> ХЕВ - external Framebuffer 


The external framebuffer resides in main memory and can be directly displayed by the video processor. 


7.2 init VI 


7.2.1 Videomodes 
7.3 render to XFB 
7.4 vertical retrace 


7.5 set XFB Address 
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8 3D Graphics Processing 


Wain CPU 


stat; | ХЕ SU 
| Transform 7 Setup 
CP | Unit Unit 


Command 


Processor | ; 


| Cache | i 


E Framebuffer 
Top ?- 


| | RGB Framebutter Compare 
| Z-Buffer 


RASL 
Texture Coordinate 
Rastenzer 


| 3D Graphics Pipeline 


8.1 basic operations 
8.1.1 load BP Register 


> write byte 0x61 to GXFIFO 
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> write 4 bytes of data to GXFIFO 


8.1.2 load CP Register 


> write byte 0x08 to GXFIFO 
> write 1 byte address to GXFIFO 


> write 4 bytes of data to GXFIFO 


8.1.3 load XF Register 


> write byte 0x10 to GXFIFO 

> write 0x0000 (16 bit) to GXFIFO 
> write addr (16 bit) to GXFIFO 

> write 4 bytes of data to GXFIFO 


8.1.4 load ХЕ Register Indexed 


> write byte 0x10 to GXFIFO 
> write n-1 (16 bit) to GXFIFO 
> write addr (16 bit) to GXFIFO 


> write n bytes of data to GXFIFO 


8.2 example processing loop 


gx init(); 
while (running) 
{ 

gx_begin(); 
drawframe(); 
gx end(); 
waitvsync(); 


) 


gx close(); 


8.21 init GX 
8.2.1.1 setup the fifos 


> fifo start/end must be 32 byte aligned 


[> minimum fifo size is 64kb 


> typical size for the hi watermark is fifo size - 16kb 
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8.2.1.2 enable gx command processing while (mfwpar () & 1); 
PI[3] = 0x100000; 

PI[4] = 0x110000; 

PI[5] = 0x100000; 

mtwpar(0xC008000); // GXFIFO physical address 

mtspr(920, mfspr(920) | 0x40000000); 


8.2.1.3 send setup frame after setting up and enabling gx command processing it is recommended to 
send a first initial тате” to setup the various internal registers to useful values. 


8.2.1.3.1 Videomodes remember that depending on the videomode some things must be setup differ- 
ently (such as the scissor, viewport, ...) 


8.2.2 begin frame 
8.23 draw frame 


8.2.4 end frame 


> load draw-done to BP register (0x45000002) 
> copy EFB to XFB 


> terminate the list by writing 32 zeroes 


8.2.4.1 сору EFB to ХЕВ #define XY(x, у) (((у) < < 10) | (x)) 

GX LOAD BP REG(0x4000001f); // set z mode 

GX, LOAD BP REG(0x410004bo); // set color mode 0 

СХ LOAD BP. REG(0x49000000 | XY(0, 0)); // set source top left 

СХ LOAD BP REG(0x4a000000 | XY(639, 479)); // set source bottom right 
GX LOAD BP КЕС(0х44000028); // stride? (0х1280> »5) ... 640*2 ; 320*YuYv 
СХ LOAD BP. REG(0x4b000000 | (0xC00000 > > 5)); // xfb target address 
СХ LOAD BP REG(PE COPY CLEAR AR | 0х0000); 

СХ LOAD BP REG(PE COPY CLEAR, GB | 0x0000); 

СХ LOAD BP REG(PE COPY CLEAR Z | OxFFFFFF); 

GX LOAD BP REG(0x52004803); // do it (efb copy execution command?) 


8.2.4.2 copy EFB to Texture simelar to copying EFB to XFB, setup BP registers 0x4a,0x4a,0x4d,0x4b 
and then (0х52000003 | (format< «4)) 


8.2.5 close GX 
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9 Joy-Bus Devices 


91 ID and Device List 


The device ID can be read by sending the SI Command 0x00, and then reading 3 bytes from the respective 
device. The response-data looks like this: 


first comes a 16bit device id: 


ID Device 


0x0500 | ? N64 Controller 
0x0001 | ? N64 Microphone 
0x0002 | ? N64 Keyboard 
0x0200 | ? N64 Mouse 
0x0004 | GBA 
0x0800 | GBA (n/a) 
0x0900 | GC Standard Controller 
0хе960 | ? GC Wavebird Receiver 
0xe9a0 | ? GC Wavebird 
0xa800 | ? GC Wavebird 
Охерро | 2 GC Wavebird 
0x0820 | GC Keyboard 
0x0800 | ? GC Steering Wheel 
0x0900 | DKongas (same as std Controller) 
? Resident Evil4 Chainsaw 
bit(s) description 
15 wireless (1: wireless Controller) 
14 wireless receive (0: not wireless 1: wireless) 
13 Rumble Motor (0: available 1: not available) 
12 Type of Controller (always 0 ?) 
11 Type of Controller (0: N64 1: Dolphin) 
10 wireless type (0:IF 1:RF) 
9 wireless state (О: variable 1: fixed) 
8 0: non standard Controller 1: Dolphin Standard Controller 
7 
6 
5 wireless origin (O:invalid 1:valid) 
4 wireless fix id (0:not fixed 1:fixed) 
3 wireless type - O:normal 1: non-controller (?) 
2 wireless type - O:normal 1: lite controller 
1 wireless type - 
0 wireless type - 


the device id is followed by 8 status bits: 
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bit(s) description 
7 ? 
6 ? 
5 ? 
4 ? 
3 ? rumble motor running 
2 2 
1 9 
0 7 


9.) standard Controller 


9.2.1 Init 


> enable all controllers in 0xcc006430 
> set Joy-channel 1-4 Command Register to 0x00400300 
> clear SI i/o buffer 


> wait until bit 31 of OxCC006434 is 0, then set it to 1 


Command Word 

0x00400000 - enable polling 
0x00000300 - ? 

0x00000100 - ? 

0x00000001 - enable rumble motor 


Commands: 

0x00 - get id+status 
0x40 - ? 

0х41 - get origins 


0x42 - calibrate ? 


9.2.2 Read Controller Status 


> simply read all Joy-channel registers and extract the info you want 
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first input word 


bit(s) Description 
31 ERRSTAT - (assumed 0) 
30 ERRLATCH - (assumed 0) 
29 unused (9) 
28 s | Start Button 
27 y | Y Button 
26 x | X Button 
25 b | B Button 
24 a | A Button 
23 unused (?) 
22 L | L Trigger 
21 R | R Trigger 
20 Z Trigger 
19 и | D-Pad Up 
18 d | D-Pad Down 
17 r | D-Pad Right 
16 1 | D-Pad Left 
8-15 | x | Analog Stick X (8bit unsigned, ~32...128...~224) 
0-7 y | Analog Stick Y (8bit unsigned, ~32...128...~224) 


second input word 


bit(s) Description 
24-31 | x | Analog C Stick X (8bit unsigned, ~32...128...~224) 
16-23 | у | Analog C Stick Y (8bit unsigned, ~32...128...~224) 
8-15 | 1 | L Trigger Analog (8bit unsigned, ~32...~224) 

0-7 r | R Trigger Analog (8bit unsigned, ~32...~224) 


9.2.3 rumble Motor On 


*(volatile unsigned long*)0xCC006400 = 0x00400001; 
*(volatile unsigned long*)0xCC006438 = 0x80000000; 


9.2.4 rumble Motor Off 


*(volatile unsigned long*)0xCC006400 = 0x00400000; 
*(volatile unsigned long*)0xCC006438 = 0x80000000; 


9.3 Keyboard 


9.3.1 Types 
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9.3.1.1 ASCII Official Nintendo/SEGA keyboard for the GameCube. It has 80 keys plus an Fn key, 
some of the keys have Japanese labelings. It has an LShift and an RShift key, but only a single Ctrl and Alt 
key. The Fn key is internal to the keyboard. It makes the keyboard send different scancodes if it is pressed, 


and an Fn keypress alone cannot be detected. 
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9.3.1.2 Datel A British IBM PS/2 keyboard that ships with an adapter. 


9.3.1.3 Tototek Adapter Converts the ІВМ PS/2 protocol to the GameCube SI protocol and also con- 
verts the PS/2 scancodes into GameCube scancodes. The keys that have Japanese labelings on the ASCII 
keyboard get mapped to keys like PrintScreen and Pause. 


0-9 and Enter send the scancodes of their counterparts on the alphanumeric part of the keyboard, 
regardless of the status of NumLock, so the Numpad cannot be used as cursor keys. 

The key right of LShift on non-US keyboards sends no scancode. 

The Pause/SysReq key only sends the keycode of 0x37 once, even if it’s pressed down continuously. 
Numpad-* sends 0x37, the same as Pause/SysReq, but this one continues sending it. 


All combinations of Pause/SysReq with other keys are possible, except for these: LStrg or LStrg 
together with Pause/SysReq doesn’t send anything. This would have been SysReq. 


The adapter easily gets confused by two keys for which it produces the same GameCube scancodes: 
If you hold down LStrg and press RStrg, the LStrg scancode will disappear even though LStrg is srill 
pressed down. The same is true for Ctrl and Alt. 


9.3.2 Scancodes 


.0 .1 .2 .3 .4 55 .6 27 
0. Home End 
1. А В С D E F G H 
2. Q R S T U V W X 
3« 7 8 9 0 - 0 =+ PrntScrn | Pause/SysReq 
NP 7 NP 8 NP 9 МР0 NP - NP/ NP * 
4, Fl F2 F3 F4 F5 F6 F7 F8 
5. | Backspace Tab CapsLock | LShift (*54) LCtrl (*56) LAIt (*57) 
6. Enter 
NP Enter 
.8 2.9 .А .В .С .D .E .Е 
0% PgUp PgDn ScrollLock 
15 І Ј K L M N О Р 
2. Ү 7. 1 2 3 4 5 6 
NP 1 NP 2 NP 3 NP 4 NP 5 NP 6 
3 [{ 5 ? 1} ‚< > /? \ 
NP + (*39) NP. 
4. F9 F10 ЕТІ F!2 ESC Ins Del - 
5: LWin space RWin Menu Left Down Up Right 
6. 
NumLock (*6a) 


(*39) Tototek adapter: makes only sence for japenese ASCII labeling 
(*54) Tototek adapter sends this code for LShift and RShift 

(*56) Tototek adapter sends this code for LCtrl and RCtrl 

(*57) Tototek adapter sends this code for LAIt and RAIt 

(*6a) Tototek adapter: undefined for GameCube 
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9.3.3 Init 


> enable controller in 0хсс006430 
> set Joy-channel Command Register to 0x00540000 
> clear SI i/o buffer 


> wait until bit 31 of OxCC006434 is 0, then set it to 1 


Command Word 
0x00540000 - enable polling 


9.3.4 Read Keyboard 


first input word 


bit(s) Description 
31 ERRSTAT - (assumed 0) 
30 ERRLATCH - (assumed 0) 
24-29 ? 
16-23 ? 
8-15 ? 
0-7 ? 


second input word 


bit(s) Description | 
24-31 |_| кеуі | 
16-23 key2 | 
8-15 key3 | 
0-7 7 | 
9.4 GBA 
to do 


9,5 Wavebird 


to do 


9.6 steering wheel 


to do 


9.7 DKongas 


These work exactly like the standard controllers from the programmers point of view, and they even have 
the same ID. 
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9.7.1 Read Controller Status 


> simply read all Joy-channel registers and extract the info you want 


first input word 


bit(s) Description 
31 ERRSTAT - (assumed 0) 
30 ERRLATCH - (assumed 0) 
29 unused (9) 
28 s | Start Button 
27 у | left Konga, top/left (У Button) 
26 x | right Konga, top/left (X Button) 
25 b | left Konga, bottom/right (B Button) 
24 a | right Konga, bottom/right (A Button) 
23 unused (9) 
22 L | unused (L Trigger) 
21 R | unused ? (R Trigger) 
20 unused (Z Trigger) 
19 и | unused (D-Pad Up) 
18 d | unused (D-Pad Down) 
17 r | unused (D-Pad Right) 
16 1 | unused (D-Pad Left) 
8-15 | x | unused (Analog Stick X) 
0-7 y | unused (Analog Stick Y) 


second input word 


bit(s) Description 
24-3] | x | unused (Analog C Stick X) 
16-23 | y | unused (Analog C Stick Y) 
8-15 | 1 | unused (L Trigger Analog) 
0-7 r | Microphone (R Trigger Analog) (8bit unsigned, ~16...?) 


9.8 Resident Evil4 Chainsaw 


to do 
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10 EXI Devices 


10.1 EXI Channel and Device List 


The following table shows the GameCube devices which use the EXI bus and their channel and device 
numbers, the EXI frequency commonly used with them and their virtual offset in EXI mapping. 


channel | device | freq offset Description 
0 0 4 Memory Card (Slot A) 
0 1 3 0x00000000 | Mask ROM 
0 1 3 0x20000000 | Real-Time Clock (RTC) 
0 ak 3 0x20000100 | SRAM 
0 1 0x20010000 | UART 
1 0 4 Memory Card (Slot B) 
2 0 AD16 (trace step) 
0 2 Serial Port 1 
0 2 5 Ethernet Adapter (SP1) 


Note: The Real-Time Clock (RTC), SRAM, and Mask ROM are actually one device mapped to differ- 
ent address offsets. The SRAM should only be accessed by the IPL and contains non-volatile system data. 
The Mask ROM contains the IPL itself (encrypted) and the system font data. 


10.2 Retrieving the ID of an EXI Device 


To retrieve the ID of an EXI Device, an EXI IMM write operation must be used to send the ID command 
(0x0000) and an EXI IMM read operation should follow it to read the actual 4 byte ID. 


ID Device 
0x00000004 | Memory Card 59 
0x00000008 | Memory Card 123 
0x00000010 | Memory Card 251 
0x00000020 | Memory Card 507 
0x00000040 | Memory Card 1019 
0x00000080 | Memory Card 2043 
0x01010000 | USB Adapter 
0x01020000 | NPDP GDEV 
0x05070000 | IS Viewer 
0x04120000 | AD16 

0x03010000 | Marlin (?) 
0x02020000 | Modem 
0x04020200 | Ethernet Adapter 


10.3 Mask ROM 


Mask ROM also referred as bootrom or IPL. Total size of bootrom is 2 MB. 
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10.3.1 Memory Map (Europe/PAL) 
Start End Size Description 
0х00000000 | 0x000000£f | 0x00000100 | Copyright message (*1) 
0x00000100 | 0x001aeee8 | 0x001aede8 | BIOS data (*2) 
0хХ001АҒҒ00 | 0х001ҒА0Е0 | 0x0004D000 | 'YayO' - ROM Fonts #1 (SJIS) 
0x61 bytes of OxFF, 0x62 , followed by zeros until ОхІЕСЕОО 
0x001FCF00 | 0x001FF474 | 0x00003000 | 'YayO' - ROM Fonts #2 (ANSI) 
0x001FF474 | 0x001FFEFO filled with 0x00 
0x001FFF00 0xOO1FFFFF | filled with Oxff 


(*1) "(C) 1999-2001 Nintendo. All rights reserved.(C) 1999 ArtX Inc. All rights reserved.PAL Revi- 


sion 1.0 " and zeros up to 0x100. 


(*2) encrypted by an XOR cyphertext which is generated by a yet unknown algorithm (probably not a 


single LFSR) 


10.3.2 Memory Map (USA/NTSC) 


Start End Size Description 
0x00000000 | 0x0015ee40 | 0x0015ee40 | BIOS data (*1) 
0х001АҒҒ00 0x0004D000 | ROM Fonts #1 (SJIS) 
0х001ЕСҒ00 0x00003000 | ROM Fonts #2 (ANSI) 
0x001FFF00 0x001FFFFF | filled with 0x00 


(*1) encrypted by an XOR cyphertext which is generated by a yet unknown algorithm (probably not a 


single LFSR) 


note: all unused space is filled with 0x00, no pieces with OxFF. 


10.3.3 Memory Map (Japenese/NTSC) 


10.3.4 


10.3.5 Font Encoding 


Memory Map (Japenese/NTSC - Panasonic Q) 


The ' YayO' data is compressed similar to the the Zelda 64 ' Yaz0' compression. Besides the Raw Font data 


it also contains some information about the Font. 


10.3.6 Font Layout 


10.3.6.1  SJIS Font (ROM Font #1) 


10.3.6.2 ANSI Font (ROM Font #2) The ANSI Font is a 512x512 Pixel Texture in I4 Format. It con- 
sists of 21 colums and 11 rows of characters which are in a 24x24 pixel grid. 
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10.3.7 Operation 
10.3.7.1 read 


D IMM write 32 bit: (offset« <6) 
> DMA read X bytes 


max offset is 2*1024*1024, max block len is ? 


10.4 RTC (Real-Time Clock) 


Real-Time Clock (RTC) is 32-bit value, counting time intervals in seconds. To get the real time (seconds 
since January 1st, 2000 12am) add the counter bias saved in SRAM. 


10.4.1 Operation 
10.4.1.1 read 


> IMM write 32 : 0x20000000 | (0< <6) (RTC offset) 
> IMM read 32-bit RTC value 


Since it is uncertain if the hardware prevents fragmented reads of the time interval (eg byte | from tick n 
and byte 2-4 from tick n+1) it is recommended to repeatedly retrieve the value until there is no difference 
between two consecutive reads. 


10.4.1.2 write 
> IMM write 32: 0xA0000000 (== 0x20000000 | 0х80000000 (write flag) | (0< <6) (RTC offset)) 


> IMM write 32-bit RTC value 


10.5 SRAM 


SRAM is battery backed memory, used for saving some non volatile settings. Size of SRAM is 64 bytes. 
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10.51 Memory Мар 
offset | end | size | Description 
0x00 2 Checksum 1 
0x02 2 Checksum 2 
0x04 4 ead 0 
0x08 4 ead 1 
0х0с 4 counter Bias (add to RTC value to get actual time) 
0x10 1 display offset H (signed value, -32...32) 
0х11 1 ntd 
0x12 1 language 
value | Description 
0 english 
1 german 
2 french 
3 spanish 
4 italian 
5 dutch 
0x13 1 flags 
bit(s) Description 
7 2 (20) 
6 2 (20) 
5 ? (=1) 
4 ? (=0) 
3 7 (=1) 
2 0: mono 1: stereo 
1 ? (20) 
0 ? (20) 
0x14 2*12 | Hash ID 
0x2c 4 wireless Keyboard ID 
0x30 4*2 | wireless PAD ID 
0x38 1 last DVD Errorcode 
0x39 1 padding/unused/reserved 
0x3a 2*2 | Flash ID checksum 
0х3е 2 padding/unused/reserved 


10.5.2 Operation 


10.5.2.1 


> IMM write 32 : 0x20000100 (== 0x20000000 | (8 < < 6) (SRAM offset)) 
> ОМА read 64 bytes. 


10.5.2.2 write 


read 
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> IMM write 32 : 0xa0000100 (== 0x20000000 | 0x80000000 (write flag) | (8 << 6) (SRAM offset)) 


> use sequential IMM writes 
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10.5.3 Checksums 


the SRAM data is protected against corruption by a simple additive checksum which is calculated like this: 


void checksums (unsigned short *buf, unsigned short *cl, unsigned short *c2) 


{ 


int 1; 
žel = 0; *c2 = 0; 
for (i = 0;1<4; ++i) 


{ 
*cl += buf[0x06 + i]; 

*c2 += (buf[0x06 + i] ^ OxFFFF); 
} 

} 


10.6 AD16 


AD106 is on channel 2, as device 0. Probably its used for debugging purposes. AD 16 is the 32-bit register, 
keeping bootrom "trace-step". 


10.6.1 Operation 
10.6.1.1 init 
D IMM write : 0x0000 
D IMM read 32 bit ID and check it for error (it should be 0x04120000) 
10.6.1.2 write 
D IMM write : 0xa0 
[> IMM write 32-bit value (trace-step) 
10.6.1.3 read 
> IMM write : 0xa2 


> IMM read 32-bit AD16 register value 


10.6.2 Trace-Step Values 


0x01000000 | AD16 Inited, cache lines 320, 340,360, 380, 3a0 prefetched 
0x02000000 | cache line 0x3e0 prefetched 

0x03000000 | rest of cachelines prefetched 

0x04000000 | ramtest passed 

0x05000000 | ramtest error 

0x06000000 | ramtest error 


10.6.2.1 BS 
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0x00000800 | System Init 
0x00000900 | DVD Init 
10.6.2.2 BS2 | 0x00000a00 | Card Init 
0х00000500 | video init 
0х00000с00 | final before menu 


10.7 Memory Cards 
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Product | Blocks | Mega bits | Mega bytes Vendor 

Memory Card 59 64 4 0.5 Nintendo 

Action Replay memory card 64 4 0.5 Datel 
Memory Card '4 Mega' 64 4 0.5 3rd Party | WINBOND 512K*8 C^ 

Memory Card 123 128 8 1 | Nintendo (*) 

Memory Card '8 Mega' 128 8 1 3rd Party 

Memory Card 251 256 16 2, Nintendo 

Memory Card 507 512 32 4 | Nintendo (*) 

Memory Card 1019 1024 64 8 Nintendo 

Memory Сага ”64 Mega’ 1024 64 8 3rd Party 

USB Memory Adaptor 64M / 1019 blocks 1024 64 8 EMS 

Memory Card 2043 2048 128 16 | Nintendo (*) 


(*) never seen those, appearently supported but never manufactured. 


as you can see the products are named in reference to their useable capacity in blocks or total size in mega 


bits. The theoretical maximum size for a memory card is 128 mega bits (16 mega bytes, 2048 blocks). 


10.7.1 Commands 


Command | len indata len | outdata len Description 
0x8500 2 - т. ID 2 get ID 

0x8300 2 - = Status 1 get Card Status 
0x89 1 - > - zi clear Card Status 
0x52 1 offset, 0x00000000 8 Block Data | «240x200 | read Block 
0хҒ40000 3 - - - - erase Card 

0хЕ1 1 Sector 2 - - erase Sector 
Oxf2 1 Block offset 4 Block Data | <=0x80 | write Block 


10.7.2 Operation 


10.7.2.1 unlocking original memory cards (those manufactured by nintendo) need to be ’unlocked’ be- 
fore they can be accessed. this is appearently done by a small dsp program. 


to do 


10.7.2.2 get ID 


[> IMM write 0x85,00 
> IMM read 2 bytes ID 
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10.7.2.2.1 Card IDs 


10.7.2.3 get Status 


[> IMM write 0x83,00 
> IMM read 1 byte Status 


7 0 
Xu. ere 
10.7.2.3.1 Status Bits bit(s) description 
7 х | 1: erase in Progress (?) 
0 т | 1: Card ready (?) 


10.7.2.4 clear Status 


D IMM write 0x89 


10.7.2.5 read Block 


select 

IMM write: 0x52 

IMM write: (offset > > 17), (offset > > 9), (offset > > 7) & 3, offset & Ox7F 
IMM write: 0x00, 0x00, 0x00, 0x00 


read 8 bit values 


deselect 


max offset is 16*1024*1024, max block len is 512 bytes. 


10.7.2.6 erase Card 


[> select 
[> IMM write Oxf4,0x00,0x00 


[> deselect 


10.7.2.7 erase Sector 


select 
IMM write Oxf1 
IMM write (sector > > 17) & Ox7F, (sector > > 9) & OxFF 


deselect 


wait until bit 7 of card status is cleared 
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10.7.2.8 write Block 


wait while bit 0 of card status is cleared (= card ready) 

select 

IMM write Oxf2 

IMM write (offset > > 17) «с Ox3F, (offset > > 9) & OxFF, (offset > > 7) & 3, offset & Ox7F 


write 0x80 bytes 


deselect 


10.8 Ethernet Adapter 


The Macronix chip found in the ethernet adapter (mx98730ec) seems to be a reenginered version of the 
mx98726 or mx98728 (or the ec type respectivly). 


10.8.1 registers 


Registerblock Base | Size of Registerblock | common access size 
0x00 0x1000 1 


These are the actual Chip Registers which match with the descriptions in MXs documents. 


0x00 | 1 | r/w | NCRA - Network Control Register A (0x08 ?) 


7 0 


2222 Pep? 


bit(s) description 
7 INTCLK - must be 0 for normal operation. 
6 INTMODE - Interrupt Mode: Set for the active high interrupt, reset for the active low interrupt case. 
5 LB1 - Loopback mode 
4 LBO 


LB1 | LBO | description 
0 0 Mode - Normal mode 
0 1 Model - internal FIFO Loopback 
1 0 Mode? - internal NWAY Loopback 
1 1 Mode3 - internal PMD Loopback 


SR - Start Receive : Enable the MAC to receive packets. Default is disabled. 


e | STI - Start Transmit Command/Status 


STO 


оњ | dM] м 


RESET - Software reset. 


bit 1 and bit 2 will get cleared after a packet has been sent 
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0x01 | 1 | r/w | NCRB - Network Control Register (0x11, 0x12 ?) | 
Te 
bit(s) description 
6-7 RXINTC - Recieve Interrupt Counter 
5 HBD - Heart Beat Check Disable 
4 AB - "pass all broadcast frames" 
3 PB - "pass bad frames" 
2 PM - "pass all multicast" 
1 CA - capture effect mode 
0 PR - promiscuous mode 
0x02 | 1 | r/w | GMAC Test Register A : TRA 
bit(s) Description 
7 SB - Start/Stop Back-off counter 
6 FC - Forced Collision 
5 RWD - Receive Watchdog Disable 
4 RWR - Recieve Watchdog Release 
1-3 TMODE - Test Moder Select bits 
0 TEST - Test mode enable 
0x03 | 1 | r/w | GMAC Test Register B : TRB 
bit(s) Description 
7 BFSTATUS 
6 ВЕ5І 
5 BKCNTLB 
4 BFSO 
3 COLCNTCB 
2 RDNCNTSB 
1 RDNCNTCB 
0 FKD - Flaky Oscillator Disable 
0x04 | 1 | r/w | LTPS - Last Transmitted Packet Status (transmit error code ?) 
bit(s) Description 
7 TERR - Transmit Error 
6 OWC - Out of Window Collision 
5 UF - TX FIFO Underflow 
4 CRSLOST - Carrier Sense Lost 
3 CC3 - Collision Count Bit 3 
2 CC2 
1 CCl 
0 CCO 
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1 | r/w | LRPS - Last Recieved Packet Status 


Description 


RERR - Recieve Error 


RF - Runt Frame 


ME - Multicast Frame address 


RW - Recieve Watchdog 


FO - FIFO Overrun 


FAE - Frame Alignment Error 


CRC - CRC error 


BF - RX Packet Buffer Full Error 


1 | r/w | MPCL - Missed Packet Counter 


Description 


MISSCNT - Miss Packet Counter LSB | 


1 | r/w | MPCL - Missed Packet Counter 


Description 


MISSCNT - Miss Packet Counter MSB 


1 | r/w | IMR - Interrupt Mask Register (IRQ Mask) 


Description 


RBFIM - RX Buffer Full Interrupt Mask 


BUSEIM - Bus Error Interrupt Mask 


FIFOEIM - FIFO Error Interrupt Mask 


TEIM - Transmit Error Interrupt Mask 


REIM - Receive Error Interrupt Mask 


TIM - Transmit Interrupt Mask 


RIM - Recieved Interrupt Mask 


FRAGIM - Fragment Counter Interrupt Mask 


1 | r/w | IR - Interrupt Register (irq status) | 


еѕг? 


0 


description 


RBFI - RX Buffer Full Interrupt 


BUSEI - Bus Error Interrupt 


FIFOEI - FIFO Error Interrupt 


TEI - Transmit Error Interrupt (1: transmit error) 


ВЕ - Recieve Error Interrupt (1: receive error 2) 


TI - Transmit OK Interrupt (1: packet sent 2) 


чу» |Ф - 


RI - Receive OK Interrupt (1: packet received ?) 


ЕКАСТ - Fragment Counter Interrupt 


2 | r/w | ВР - Boundary Page Pointer Register (0х0100 2) 
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0х0с r/w | TLBP - TX Low Boundary Page Pointer Register 
0x0e r/w | TWP - Transmit Buffer Write Page Pointer Register 
0x10 ?/? | unused/reserved 
0x12 г/м | TRP - Transmit Buffer Read Page Pointer Register 
0x14 r/w | RXINTT - Receive Interrupt Timer 
0x16 r/w | RWP - Receive Buffer Write Page Pointer Register 
0x18 r/w | RRP - Receive Buffer Read Page Pointer Register 
Oxla r/w | RHBP - RX High Boundary Page Pointer Register (OxOf00 ?) | 
0х1с t/w | EEPROM Interface Register: 
bit(s) Description 
6-7 unused/reserved 
5 EELD - 
4 EESEL - 
3 EEDO - Serial Data Output from external EEPROM clock device 
2 EEDI - Serial Data Input to external EEPROM clock device 
1 EECK - Serial Clock output to external EEPROM clock device (< 1 MHz) 
0 EECS - Chip Select output to external EEPROM clock device 
0х1а t/w | ВІСТ - Bus Integrity Check Timer 
Oxle r/? | IORDP - IO Data Port Page Pointer Register 
0x20 г/у | PARO-PAR5 Network Address Filtering Registers - Physical (MAC) Address 
0x26 t/w | MARO-PAR7 Network Address Filtering Registers - Hash Table Register 
0х2е t/w | ANALOG - Transceiver Control Register | 
bit(s) Description 
6-7 unused/reserved (must be 0) 
5 RST100 - Reset for NORMAL mode 
4 RSQ - Reduced SQuelch Enable 
3 PWD100 - Reset for NORMAL mode 
2 PWDIOB - Set for NORMAL mode 
1 DS130 - Must be 1 for NORMAL mode with auto-compensation 
0 DS120 - Must be 1 for NORMAL mode with auto-compensation 
0x2f r/w | DINTVAL - DMA Interval Timer 
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0x30 | 1 | r/w | NWAYC - NWAY Configuration Register 


bit(s) Description 
7 LTE - Link Test Enable 
6 NTTEST - reserved 
3-5 ANS - Autonegotiation Status 
2 ANE - Autonegotiation Enable 
1 PS100/10 - Port Select 100/10 Mbit 
0 FD - Full Duplex Mode 


0x31 | 1 | r/- | NWAYS - NWAY Status Register 


bit(s) description 

7 10TXH - NWAY 10 TX Half duplex Mode 
6 10TXF - NWAY 10 TX Full duplex Mode 
5 100TXH - NWAY 100 Half duplex Mode 
4 100TXF - NWAY 100 TX Full duplex Mode 
3 ANCLPT - Auto-negotiation Completion 
2 
1 
0 


LPNWAY - Link Partner NWAY Status 
LS100 - Physical Link Status of 100Mbps TP 
LS10 - Physical Link Status of 10 Mbps TP 


0x32 | 1 | r/w | GCA - GMAC Configuration A Register (0x08 2) | 


bit(s) description 
7 unused/reserved (must be 0) 
6 TXFIFOCNTEN 
5 AUTOPUB - Auto Page Update option 
4 unused/reserved 
3 ARXERRB - Accept RX packet with error 
2 
1 
0 


SLOWSRAM 
PBW - Packet Buffer Data Width 
BPSCRM - Bypass Scrambler 


0x33 | 1 | r/w | GCB - GMAC Configuration B Register 


bit(s) description 
4-7 unused/reserved 
2-3 RTHD - Recieve FIFO Threshold 
0-1 TTHD - Transmit FIFO Threshold 


0x34 | 4 | -/w | TWD - IO Mapped Data Port 


0x38 | 2 | -/- | unused/reserved 
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ОхЗа | 1 | r/w | Host Interface Protocol Register (0x08 2) 
Tor) 
bit(s) description 
2 DREQB - DREQB-pin status bit 
1 STIORD/RRDYB - (no data available 2) 
0 WRDYB - Write Packet Memory Ready Bar Status Indication 
0x3b | 1 | r/- | LPC - Link Partner Link Code Register | 
0х3с | 1 | r/w | TX/RX DMA Status Register 
0x3d | 1 | r/w | MISCI - MISC Control Register 1 
0х3е | 2 | r/w | TXFIFOCNT - TX FIFO Byte Counter | 
0x40 | 4 | r/- | ККО-КХ Burst Read Data Port 
0x44 | 2 | r/- | IDI - МХ? 
0x46 | 2 | r/- | ID2- 0001’ 
0x48 | 4 | w | WRTXFIFOD - Write TX FIFO Data Port Register (output queue) | 
0х4с | 4 | r/- | ТОКО - IO Read Data Port Register 
0x50 | 1 | r/w | MISC2 - MISC Control Register 2 (0x80 2) 
0x51 11| 71 ©) 


note: register 0x51 is not documented in mx98728 datasheet 


0x52 


2 


r/- 


HRPKTCNT - Host Recieve Packet Counter 


0x54 


r/w 


FRAGCNT - Host DMA Fragment Counter 


note: 0x56 is the last reg of a mx98726 and mx98728 


0x5b 


? 


9? 


@) 


0х5с 


2? 


(2) 


0x36 = disconnect network 


0x5e 


2? 


(0х01 ?) 


179 


10 EXI DEVICES 180 


0x60 | ? | 7/7 | (0x00 ?) 


0x100 | OxfOO | ?/w | input queue (?) 


- select for reading 
- IMM read block 


10.8.2 command-registers 


Registerblock Base | Size of Registerblock | common access size 
0x00 0x10 1 


These Registers are related to the EXI Interface on the Ethernet-Adapter, not to the actual Ethernet Chip. 


0x00 | ? | 927 | EXI id 


- select register for reading 
- IMM read 4 bytes (0x04,0x02,0x02,0x00) 


0х01 | ? | 2/2? |? 


0x02 | ? | ?/? | irq mask 


0x03 |? | ?/? | irq status 


r??p  h??? 


bit(s) description 
7 r | irq from MX chip 
6 ? | killing’ irq (should not get this one) 
5 ? | command error 
4 p | challange/response request 
3 h | challange/response status 


0x04 | ? | ?/? | ? (еуі eth) | 


- select register for writing 
- IMM write 0xd1,0x07 (16bit) 


0x05 | ? | 2/2 | ? (0x4e ?) 


0x06 | ? | 2/2? |? 


0x07 |? | 2/2 | ? 


10 EXI DEVICES 


0x08 |? | ?/ | Challenge 


- select for reading 
- IMM read 4 bytes 


0x09 | ? | ?/? | Response 


- select for writing 
- IMM write 4 bytes 


0x0a | ? | 92/2 |? 


0Ox0b | ? | ?/? | Status 


1: challenge/response ok 
2: challenge/response failed 


0x00 | ? | 2/2? |? 


0x0d | ? | ?/? |? 


0x0e | ? | 2/2 |? 


Ox0f | ? | 2/? ? (0x00 ?) | 


10.8.3 Operation 
10.8.3.1 selecting a register for reading 


> IMM write 0x80000000 | (register <8) 


10.8.3.2 selecting a register for writing 


> IMM write 0xc0000000 | (register« <8) 


10.8.3.3 selecting command-register for reading 


[> IMM write (register< <8) (16 bits) 


10.8.3.4 selecting command-register for writing 


> IMM write 0x4000 | (register< <8) (16 bits) 
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10.8.3.5 init 


write reg - 1 byte to 0x60, 0x00 

read reg - 1 byte from OxOf (?) 

delay 

write reg - 1 byte to 0x00, 0x01 

write reg - 1 byte to 0x00, 0x00 (not necessary ?) 

read reg - | byte from 0x01, 0x00 

read reg - 1 byte from Ox5b 

write reg - 1 byte to Ox5b, write back previously read value AND ~(1< <7) 
write reg - 1 byte to Ox5e, 0x01 (or same as Ox5b ?!) 

read reg - 1 byte from Ox5c 

write reg - 1 byte to Ox5c, write back previously read value OR 4 
write reg - 1 byte to 0x01, 0x11 

write reg - 1 byte to 0x50, 0x80 (?) 

write reg - 1 byte to 0x08, Oxff 

write reg - 1 byte to 0x09, Oxff 

write reg - 1 byte to 0x02, 0x00 (?) 

write reg - 1 byte to 0x00, 0x08 

delay 

write reg - 2 bytes to 0x16, 0x0100 (recv buffer write ptr) 


write reg - 2 bytes to 0x18, 0x0100 (recv buffer read ptr) 


10.8.3.6 challenge/response calculation 


132 ETHChallResp(u32 val,u32 revid 0,u32 revid_eth_0,u32 revid eth 1) 


{ 
132 с0,с1,с2,с3; 


с0= ( 
( ((7а1&0хЕЕ000000) > >24) + 
((уа1%0х00ҒҒ0000)>>16) * Oxcl + 0x18 + revid 0 ) 
^ ( ((val&0x000000ff) * ((уа1&0х0000ЕЕ00) > >8)) + 0x90 ) 


) & Oxff; 
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( ((7а1&0х00ЕЕ0000)>>16) + ((,уа1%0х0000ҒҒ00)>>8) + 0x90 ) 
^ (c0 + ((val&0xff£000000)>>24) - Oxcl ) 
) & Oxff; 


( ((val&0x0000£f00)>>8) + Oxc8 ) 
^ (c0 + ((revid eth 0 + revid 0 * 0x23) ^ 0x19) ) 
) & Oxff; 


( ((val&0xf£000000)>>24) + Oxcl ) 
^ ( (val&0x000000ff) + ((revid eth 1 + 0хс8) ^ 0x90) ) 
) & Oxff; 


return ((с0 << 24) | (cl << 16) | (c2 << 8) | (c3)); 


10.8.3.7 send packet (outside interrupt) 


write reg - X bytes to 0x48, <senddata> (X must be >=0x3c!) 

read reg - | byte from 0x00, status ? 

write reg - 1 byte to 0x00, 0x00 

write reg - 1 byte to 0x00, previously read status OR 0x04 (set bit3, ACK error?) 


read reg - | byte from 0x00,status ;do while (status AND 0x06)!=0 (wait until packet sent) 


10.8.3.8 poll received packets (outside interrupt) 


read reg - 2 bytes from Ox16, write ptr 

read reg - 2 bytes from 0x18, read. ptr 

if write ріг==геаа ptr, no more packets are available 

write reg - 1 byte to 0x3a, 0x02 

read reg - | byte from 0x3a, if (value&2)!=0, no more data is available 


read reg- 4 bytes from read ptr, packet descriptor 
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read reg - X bytes from 0x100+read_ptr, «data» (X must be >=0x3c! ; wrap around to 0x100 if 


read ptr-Oxf00) 

write reg - 2 bytes to 0x18, first byte of packet descriptor, 0x00 (advance read pointer) 
write reg - 1 byte to 0x09, 0x02 

write cmd - 1 byte to 0x02, Oxf8 (ACK?) 
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10.8.3.9 received packet format first 4 bytes of a received packet contains a descriptor about the packet 
that has been received 


31 24 | 23 16 | 15 8 
уууу хххх хххх 
bit(s) Description 
20-23 | y | length of received packet lo bits (shift 4 down) 
8-15 | x | length of received packet hi bits (shift 4 up and OR with lo bits) 


length is inclusive the 4 byte descriptor! 


10.9 UART 


(note: the existance of an UART is highly speculative and was never proved for a fact) 


to do 


10.10 SD Cards 


SD cards support an SPI mode, which is essentially the same hardware protocol that official memory 
cards use. Notice the use of the word hardware, not software. SD cards uses the MMC command set for 
communication and data transfer, while Nintendo memory cards use a custom Macronix command set. 
This means that you should not waste your time trying to get standard GC programs to recognize the SD 
card as anormal memory card, because it will not work without specific code to access the SD card. Even 
if you make the raw sector data on the SD card the same as the Nintendo memory card, the low-level 
commands to access the sectors differ between the two. However, since the hardware bus and protocol are 
the same, an SD adapter can essentially be made with straight-through connections from the EXI bus to the 


SD card signals. 


to do 


10.11 "Viper "Modchip" 


this is a 3rd-Party 'modchip' used to override the IPL with a custom program. 


todo 


10.12 Ripper III GC 'Modchip' 


todo 


10.13 Qoob ’Modchip’ 


todo 


10.14 NinjaMOD ’Modchip’ 


todo 
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11 HSP Devices 


НӘР devices seem to be accessable through the ARAM interface with offsets beyond 16МВ. 


11.1 GB Player 


to do 
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12 Memory Card Structure 


12.1 Overview 


one "block" on memcard equals 0x2000 bytes, the first 5 blocks are used for the filesystem (0xa000 bytes). 


Offset Size Description 

0x0000 | 0x2000 | Header 

0x2000 | 0x2000 | Directory 

0x4000 | 0x2000 | Directory backup (*) 

0x6000 | 0x2000 | Block Allocation Map 

0x8000 | 0x2000 | Block Allocation Map backup (*) 
0xa000 file(s) data 


(*) If a change is to be made that will alter the Master File Table, such as moving or deleting a file, 
copying a file from another memory card, or creating a new save game file, the GameCube will first backup 
the Master File Table to this location. Presumably, if the operation fails for certain reasons, the GameCube 
will restore the Backup File Table to the Master File Table. 


12.2 Header 


Offset Size | Description 

0x0000 ? 

0х000с 8 | time of format (OSTime value) 
0x0014 unique card id (?) 

0x0020 2 | padding zeroes 

0x0022 2 | size of memcard in Mbits 
0x0024 2 | encoding (ASCII or japanese) 
0x0026 unused (Oxff) 

0х01Ға 2 | update Counter (2, probably unused) 
0х01їс 2 | Checksum 1 (?) 

0х01Ғе 2 | Checksum 2 (2) 

0х0200 | 0х1е00 | unused (Oxff) 


12.3 Directory 


Offset | Size | Description 

0x0000 Directory Entries (max 127) 
Ox0ffa 2 update Counter 

Ox0ffc 2 Checksum 1 

Ox0ffe 2 Checksum 2 
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12.3.1 Directory Entries 


offset | length | description 
0x00 0x04 | Gamecode 
0x04 0x02 | Makercode 
0x06 0x01 | reserved/unused (always Oxff, has no effect) 
0x07 0x01 | banner gfx format and icon animation (Image Key) 
bit(s) | description 
2 Icon Animation 0: forward 1: ping-pong 
i 0: No Banner 1: Banner present 
0 Banner Color 0: RGB5A3 1: CI8 
0x08 0x20 | filename 
0x28 0x04 | Time of file's last modification in seconds since 12am, January 1st, 2000 
0x2c 0x04 | image data offset 
0x30 0x02 | icon gfx format (2bits per icon) 
bits | Description 
00 | noicon 
01 | CI8 with a shared color palette after the last frame 
10 | RGB5A3 
11 | CI8 with a unique color palette after itself 
0x32 0x02 | animation speed (2bits per icon) (*1) 
bits | Description 
00 | noicon 
01 | Icon lasts for 4 frames 
10 | Icon lasts for 8 frames 
11 | Icon lasts for 12 frames 
0x34 0x01 | file-permissions 
bit | permission | Description 
4 | no move File cannot be moved by the IPL 
3 | no copy File cannot be copied by the IPL 
2 | public Can be read by any game 
0x35 0x01 | copy counter (*2) 
0x36 0x02 | block no of first block of file (0 == offset 0) 
0x38 0x02 | file-length (number of blocks in file) 
0x3a 0x02 | reserved/unused (always Oxffff, has no effect) 
0x3c 0x04 | Address of the two comments within the file data (*3) 
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(*1) Clearly, the animation rate is unimportant when there is only one frame of icon data; nevertheless, 
a value for that one frame must still be set, or that one frame will not be shown. It is illegal to specify that 
a frame does not exist if it does; a value of 00 indicates that no frame exists, and should not be mistaken 
for meaning that this frame should not be shown. If you specify blank frames to slow the frame rate, these 
also cannot be 00. 


(*2) This byte contains an 8-bit integer that indicates how many times the file has been copied from one 
memory card to another. 


(*3) Each file has two 32 character strings which the IPL displays at the bottom of the memory card 
screen, next to the banner. The two strings (64 bytes) must fit within one block (8192 bytes), they are not 
allowed to cross sector boundaries. 
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12.3.1.4 Image Data Image data consists of a banner image and an icon. The banner image is not 
required, dependant on the value of the Image Key. If the banner image is not present, the icon image is 
displayed where the banner image would be displayed (centered horizontally). The icon image is required, 
and immediately follows the banner if present. Otherwise, it is located at the start of the image data. 


12.3.1.1.1 Banner Image Тһе banner size is 96*32 pixels, making 3072 pixels іп total (= 0x0c00 bytes 
in 8bit, 0x1800 bytes in 16bit mode). If the Banner is in CI8 mode, the palette follows immediately after 
the banners pixel data. 


12.3.1.1.2 Icon Image Immediately following the banner (if present) is the Icon Image. This can have 
a variable number of frames (up to eight), each 32*32 pixels, making 1024 pixels per frame in total. (= 
0x0400 bytes in 8bit, 0х0800 byte in 16bit mode). If the Icon is in CI8 mode, its palette either follows 
immediately after its pixel data or after the pixel data of all 8 icons, depending on the icon gfx format field. 


12.3.1.1.3 Palettes Palettes in the image data are in RGB5A3 pixel format, and аге 0x100 entries large. 
(= 0x200 bytes) 


12.4 Block Allocation Map 


Offset Size Description 

0x0000 2 Checksum 1 

0x0002 2 Checksum 2 

0x0004 2 update Counter 

0x0006 2 free Blocks 

0x0008 2 last allocated Block 
0х000а | 0х1ҒҒ8 | Map of allocated Blocks 


This is an array of OxOffc 16 bit values, each holding info about one allocated block on the memory card. 
(thus the maximum memcard size is limited to 2048 blocks (16 Megabytes, 128Mbit)) 


each 16 bit value at position X in the array has the following meaning: 


value Description 
0x0000 | block is not allocated (ie, free) 
Oxffff | lastallocated block of a file 
any other | allocated block, usually equals (x+1) (==next block of file) 


scan through a file like this: 


thisblock-firstblock; 
do 
{ 
// process block 
// next block 


thisblock=((unsigned short*)0x6000) [thisblock]; 
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while (thisblock!=0xffff) ; 
note: 


although this scheme could do it, i have never stumbled about a file yet that is NOT linear on the memcard 
anyway. from this point of view using this allocation map seems to be a bit stupid...more testing needed :) 


12.5 Checksums 


The Checksums for the Directory and Block Allocation Map are simple 16bit additive checksums (ie noth- 
ing fancy or particular safe) which can be easily calculated like this: 


void checksums (unsigned short *buf, int num, unsigned short *cl, unsigned short *c2) 


int i; 
хс1 = 0;*c2 = 0; 
for (i = 0; i < num; ++i) 
{ 
хс1 += buf [1]; 


*c2 += (buf[i] ^ Oxffff); 


if (*cl == Oxffff) 


if (*c2 == Oxffff) 


хс2 = 0; 
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13 DVD Structure 
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total capacity of disc data is 1,459,978,240 bytes (1.5 GB approx.). that’s exactly 712880 DVD raw sectors 


(each 2048 bytes). 
start end size Description 
0x00000000 0x0440 Disk header ("boot.bin") 
0x00000440 0x2000 Disk header Information ("bi2.bin") 
0x00002440 (0x2000 ?) | Apploader ("appldr.bin") 
FST (fst.bin’) 
13.1 Disk header 
start end size Description 
0x0000 | 0x0003 | 0x0004 | Game Code 
1 | Console ID 
2 | Gamecode 
1 | Country Code 
0x0004 | 0x0005 | 0x0002 | Maker Code 
0x0006 0x0001 | Disk ID 
0x0007 0x0001 | Version 
0x0008 0x0001 | Audio Streaming 
0x0009 0x0001 | Stream Buffer Size 
0x000a | 0x001b | 0x0012 | unused (zeros) 
0х001с | 0х001Ғ | 0х0004 | DVD Magic Word (0xc2339£3d) 
0х0020 | 0х03ҒҒ | 0х03е0 | Game Name 
0x0400 | 0x0403 | 0x0004 | offset of debug monitor (dh.bin) ? 
0х0404 | 0x0407 | 0x0004 | addr (?) to load debug monitor ? 
0x0408 | 0x041f | 0x0018 | unused (zeros) 
0x0420 | 0x0423 | 0x0004 | offset of main executable DOL (bootfile) 
0x0424 | 0x0427 | 0x0004 | offset of the FST ("fst.bin") 
0x0428 | 0x042B | 0x0004 | size of FST 
0x042C | 0x042F | 0x0004 | maximum size of FST (usually its same as FST size) (*) 
0x0430 | 0x0433 | 0x0004 | user position (?) 
0x0434 | 0x0437 | 0x0004 | userlength (?) 
0x0438 | 0x043b | 0x0004 | (?) 
0x043c | 0x043f | 0x0004 | unused (zeros) 


(*) multiple DVDs must use it, to properly reside all FSTs. 


13.2 Disk header Information 


this is loaded to the Address in 0x800000£4 when a disc is initialized by the IPL 
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offset | end | size | Description 
0x0000 4 | Debug-monitor Size 
0x0004 4 Simulated Memory Size 
0x0008 4 | Argument offset 
0х000с 4 | Debug flag 
0x0010 4 | Track Location 
0x0014 4 | Track size 
0x0018 4 | Countrycode 
0x001c 4 |? 


13.3 Apploader 


offset end size | Description 

0x0000 | 0x0009 Date (version) of the apploader in ASCII 

0x000A | 0х000Ғ padding (0) 

0х0010 | 0х0013 4 | Apploader entrypoint 

0х0014 | 0х0017 4 size of the apploader (32 bit) (usually 0х2000) 
0х0018 | 0x001b | 4 | trailer size 

0x0020 Apploader code (loaded to 0x81200000 in RAM) 


13.4 Format of the FST 


start | end | size | Description 

0x00 | 0х0с | 0х0с | Root Directory Entry 

0х0с 0х0с | more File- or Directory Entries 
String table 


13.4.1 Format of a File Entry 


start | end | size | Description 

0x00 1 flags; 0: file 1: directory 

0х01 3 filename, offset into string table 

0x04 4 file_offset or parent_offset (dir) 

0x08 4 file_length or num_entries (root) or next_offset (dir) 
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14 general File Formats 


141 BNR (Banner file format) 


this is the format of the file 'opening.bnr' (file size: always 6.496 bytes) found in the root directory of every 
Gamecube disc. This file is the little image that is displayed in the cube menu when inserting a disc into 
the gamecube, when in menu mode. 


start end size Description 

0х0000 | 0x0003 | 0x0004 | Magic Word "BNRI" (US/JP) or 'BNR2' (EU) 
0x0004 | 0х001Ғ padding zeroes 

0x0020 | 0x181f | 0x1800 | Graphical Data (Pixel-format is RGB5A1) 
0x1820 | 0x183f | 0x0020 | Gamename (*) 

0x1840 | 0x185f | 0x0020 | Company/Developer (*) 

0x1860 | 0x189f | 0x0040 | Full Game Title (*) 

0х18а0 | 0x18df | 0x0040 | Company/Developer Full name, or description (*) 
0x18e0 | 0x195f | 0x0080 | Game Description (*) 


(*) All Text is all stored in either SHIFT-JIS or ASCII, depending on the region of the Game. 


note: In the filesystem of european Games with multi-lingual text there may be several .bnr files (open- 
ing.bnr, openingUS.bnr, openingEU.bnr, openingJP.bnr). The opening.bnr is a BNR2 file, it is just like a 
regular BNR file, except that the metadata at the end repeats several times in different languages. 0x1820 
through 0x1960 are the first, and it continues in blocks of 0x0140. 


14.2 DOL (Gamecube Executable) 


This is a custom GameCube program file format, which is directly booted by GameCubes' BIOS (to be 
exact, by the apploader on retail discs. a different apploader could well load a binary in whatever different 
format.). 


start end size | description 

0x0000 | 0x001B Text[0..6] sections File Positions 
0x001C | 0x0047 Data[0..10] sections File Positions 
0x0048 | 0x0063 Text[0..6] sections Mem Address 
0x0064 | 0x008F Data[0..10] sections Mem Address 
0x0090 | 0х00АВ Text[0..6] sections Sizes 

0х00АС | 0x00D7 Data[0..10] sections Sizes 
0x00D8 0x04 | BSS Mem address 

0x00DC 0x04 | BSS Size 

0х00Е0 0x04 | Entry Point 

0х00е4 0х1с | unused 

0х0100 Start of sections data (body) 


14.3 ELF (Executable and linkable Format) 


The ELF format is a standard, known format for debugging target specific code, etc. GCC targeted for the 
PPC 750 processor or even for the specialized Gekko processor has a final output of ELF format files. The 
exact GameCube ELF file format details are currently unknown, but they should be similar to the standard 
specification. 
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14.4 ССВ (QOOB Flash Files) 


start | end | size | description 

0x00 | 0x03 4 ID, indicates whats in the block 
0x28432920 | '(C) ' - qoob bios file 
0x454c4600 | 'ELFNO' - ELF File 
0х42494е00 | (not yet) 'BINVO' 
0х444Ғ4с00 | (not yet) *DOL\0’ 
0x04 | Oxf7 description, will be shown in boot menu (by the qoob bios) 
Oxf8 | Oxfb 4 reserved 

Oxfc | Oxff 4 size of block 

0x100 | ... data 


14.5 GCM (Gamecube Disc Image) 


These files are always 1.4GB's exactly and each contains a complete binary image of a proprietary format 
GameCube DVD. This file format is used for the NR-Writer DVD writing software which writes special 
DVDs that can only be read by NR-Reader GameCubes. The GCM file format can probably be closely 
compared to the ISO file format for CDs in its purpose. 


14.6 GCI (Gamecube Game Save) 
Used by the EMS Memory Adapter. 


64 byte header (equal to FST entry on memcard), followed by the file data (as on memory card) 


14.7 GCP (Gamecube Memorycard Image) 
Used by the EMS Memory Adapter. 


this is a raw image of all blocks of a memory card. 


14.8 TGC 


a proprietary image format found on demo discs and eg the zelda n64 emu 


note: there seem to be tgc files on european discs that follow a different layout (no header). 
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14.8.1 Header 
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start end size description 

0х0000 | 0x0003 | 0x0004 | TGC-Magic (0хае0Е38а2) 

0x0004 | 0x0007 | 0x0004 | ? (=0x00000000) 

0x0008 | 0x000b | 0x0004 | TGC-Header Size (=0x00008000) 
0х000с | 0х000Ғ | 0x0004 | ? (=0x00100000) 

0x0010 | 0x0013 | 0x0004 | Offset to FST inside embedded GCM 
0x0014 | 0x0017 | 0x0004 | FST Size 

0x0018 | 0x001b | 0x0004 | max FST Size 

0х001с | 0х001Ғ | 0x0004 | Offset to Boot-DOL inside embedded GCM 
0x0020 | 0x0023 | 0x0004 | Boot-DOL Size 

0x0024 | 0x0027 | 0x0004 | ? 

0х0028 | 0x002b | 0x0004 |? 

0x002c | 0х002Е | 0x0004 | Offset to Banner inside embedded GCM ? 
0x0030 | 0x0033 | 0x0004 | Banner Size ? 

0x0034 | 0x0037 | 0x0004 | ? 


14.8.2 embedded GCM 


usually starts at offset 0x00008000 (after the TGC Header) and follows exactly the same layout as a GCM 


file, with the following exceptions: 


> Boot-DOL offset, FST offset contain bogus data and must be substituted by the data found in the 
TGC header 


[> offsets within the embedded GCM file must be calculated relative to the start of the embedded GCM 
(obviously) 


14.9 VGC (Viper Flash Files) 


start | end | size | description 
0x00 | 0x03 4 | Viper Magic ( VIPR’) 
0x04 1 Configuration Flags 
bit(s) | description 
7 GC_FLASH_ACCESS - allows access to the flashrom 
6 ? 
5 ? 
4 ? 
3 COMMAND MODE - enables modchip command mode (requires extended mode) 
2 EXTENDED МОРЕ - allows reading of original IPL 
1 COBRA_ENCRYPTION - enables additional encryption mode 
0 DISABLE_CHIP - disables the modchip 
0x05 1 Lid Sensor Status at Boot Time (*2) 
0 | LID OPEN 
1 | LID CLOSED 
2 | LID PASSTHROUGH 
0x06 | 0х0Ғ | 10 | padding (zeros) 
0x10 | Oxlf | 16 | BIOS Name in Ascii 
0x20 Encrypted (*1) BIOS, loaded to 0x81300000 


(*1) encrypted with the IPL XOR-Stream 
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(*2) original docs state that the default value is 0x££, however actually using this value seems to cause 
problems. 
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15 Game File Formats 


This Section contains information about files used in, or produced by the official SDK, and thus is primarily 
useful for those who are hacking retail games. 


15.1 AFC (audio stream) 


15.2 AST (audio stream) 


like afc but with tags? 


15.3 ARC (RARC Archive) 


This file is an archive file and contains several other files. 


15.3.1 Header 


The file starts with an Rarc-Header: 


start | end | size | description 
4 | type - RARC 
4 size, size of the file 
4 unknown 
4 dataStartOffset, where does the actual data start? You have to add 0x20 to this value. 
16 | unknown 
4 numNodes 
8 unknown 
4 fileEntriesOffset 
4 unknown 
4 stringTableOffset, where is the string table stored? You have to add 0x20 to this value. 
8 unknown 


15.3.2 Nodes 


Next are RarcHeader.numNodes Node structures: 


start | end | size | description 
4 | type 
4 | filenameOffset, directory name, offset into string table 
2 unknown 
2 numFileEntries, how many files belong to this node? 
4 | firstFileEntryOffset 


Each RARC file contains at least one Node, the °’ ROOT’ node. For each subdirectory in the archive, there's 
another Node (so each Node represents a directory). Each Node contains files and directories, represented 


by FileEntry structures: 
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15.3.3 File Entries 


start | end | size | description 


2 | id, file id. If this is OXFFFF, then this entry is a subdirectory link 


unknown 


unknown 


filenameOffset, file/subdir name, offset into string table 


dataOffset, offset to file data (for subdirs: index of Node representing the subdir) 


dataSize, size of data 


ыыы 


zero, seems to be always '0' 


To read the archive, you read the root node and its file entries. For each subdir in the root node's fileentries, 
you read the corresponding node and its file entries. For each file in the fileentries, you dump its data. 


15.4 ARC (audio stuff) 


if a .arc file doesnt start with 'RARC'" it may contain audio data 


15.5 ASN 


audio related, contains strings 


15.6 AW ("audio wave''?) 


15.7 BAS ("audio script" ?) 


seems to have to do with audio (check mkdd file names...) 


15.8 BCA 


looks very similar to a .col file, only with some tags in it 


15.9 BCK (animation of a .bmd skeleton) 


15.10 BDL 


same as .bmd 


15.11 BFN (font) 


images of characters + mapping from character code to corresponding image part 


15.12 BIN (binary file) 


scene.bin in sms contains scene layout 
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15.13 BLO (screen layout for dialog screens) 
15.14 BMD (3d model with texture and skeleton) 


15.15 BMG 


messages, subtitles, ... (text) 


15.16 BMP (window bitmap (!)) 


15.17 BMT 


seems to contain a MAT3 block of a .bmd file 


15.18 ВСК ("Раск" file) 


15.19 BRK 


animation stuff? rotation keys? 


15.20 BTI 


Note: some .bti files are Yaz0-compressed (if the first 4 bytes are ’Уа20?), if this is the case you have to 
uncompress them first. 


A .bti file stores a single image, but can store several mipmaps. The file starts with a texture-header (which 
is used іп the TEX! section of bmd/bdl and jpa files to store textures aswell): 
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15.20.1 Texture Header 
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start | end | size | description 
0x00 1 format 

O | T4 (4 bit intensity, 8x8 tiles) 

1 | I8 (8 bit intensity, 8x4 tiles) 

2 | IA4 (4 bit intensity with 4 bit alpha, 8x4 tiles) 

3 | IAS (8 bit intensity with 8 bit alpha, 4x4 tiles) 

4 | RGB565 (4x4 tiles) 

5 | RGB5A3 (*) (4x4 tiles) 

6 | RGBAS (4x4 tiles in two cache lines - first is AR and second is GB) 

8 | СМ (4 bit color index, 8x8 tiles) 

9 | CI8 (8 bit color index, 8x4 tiles) 

10 | СПАХ2 (14 bit color index, 4x4 tiles) 

14 | CMP (S3TC compressed, 2x2 blocks of 4x4 tiles) 
0x01 1 unknown 
0x02 | 0x03 2 width 
0x04 | 0x05 2 | height 
0x06 | 0x07 2 unknown 
0x08 1 unknown 
0x09 1 Palette Format 

0 | IA8 

1 | RGB565 

2 | RGB5A3 (*) 
0x0a | 0x0b 2 Palette Entries - number of entries in the Palette 
0х0с | 0х0Ғ 4 Palette Offset - offset to Palette Data 
0x10 | 0x13 4 unknown 
0x14 | 0x15 2 unknown 
0x16 | 0x17 2 unknown 
0x18 1 mipmap count 
0x19 1 unknown 
Oxla | 0x1b 2 unknown 
0х1с | Ox1f | 4 | Data Offset - offset to image Data 


(*) RGB5A3 is RGB5 if color value is negative and RGB4A3 otherwise. 


Offsets are relative to the Texture Header (this is important in bmd/bdl files). 


15.21 BTP 


99% sure that this contains texture animation (NOT texture coordinate animation) 


15.22 BTK 


(curves??? kinematics??) translation keys? probably some material animation as well (texture coord 


anim?) 


15.23 COL (collision triangles) 


15.24 DZB 


collision data ? 
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15.25 НАМ 


a proprietary Movie Format found on some Gamecube Game DVDs. Probably related to the HVQ (Hirar- 
chical Vector Quantization) format developed by Hudson. 


15.26 JPA (particle data) 


(TEX1 section contains .bti images) 


15.27 JPC 


collection of .jpa files ("Particle paCk"?) 


15.28 МТН (Mute thp?’) 


video format, has the same video frame format as thp, but headers are a bit different 


15.29 PAD 


recorded controller data? 


15.30 PRM (’Parameters?’) 


15.31 REL (relocatable module) 


some kind of .dll or similar, contains text and data sections and relocation info 


15.32 SB 


?, contains a stringtable 


15.33 575 (packed RARC Archive) 


This is a Yaz0-compressed RARC archive 


15.34 THP (video format) 


.thp is a video format on the gamecube. The video frames are independent "quasi-jpegs", and if audio 
frames are present, they are in an adpcm format (described below). 
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15.34.1 Header data 


The file starts with a thp header: 


start | end | size | description 
0x00 | 0x03 4 Magic Bytes, 0x54485000 СТНРО” 
0x04 | 0x07 4 Version 
0х00010000 | v1.0 
0x00011000 | v1.1 
0x08 | 0x0b 4 maxBufferSize - maximal buffer size needed for one complete frame (header + video + audio) 
0х0с | Ox0f | 4 | maxAudioSamples - != 0 if sound is stored in file, maximal number of samples in one frame. 
0x10 | 0x13 4 FPS (float value) 
0x4lefc28f | -29; NTSC | 
0x14 | 0x17 4 | numFrames - number of frames in the thp file 
0x18 | Ox1b 4 firstFrameSize - size of first frame (header + video + audio) 
0х1с | Oxlf | 4 | dataSize - size of all frames (not counting the thp header structures) 
0x20 | 0x23 4 | componentDataOffset - ThpComponents stored here (see below) 
0x24 | 0x27 4 offsetsDataOffset - if != 0, offset to table with offsets of all frames? 
0x28 | Ox2b 4 firstFrameOffset - offset to first frame's data 
0x2c | Ox2f 4 lastFrameOffset - offset to last frame's data 


15.34.2 Components structure 


At ThpHeader.componentDataOffset, a ThpComponents structure is stored: 


start | end | size | description 
0x00 | 0x03 4 | numComponents - usually 1 or 2 (video or video + audio) 
0x04 | 0x13 | 16 | componentTypes - each byte specifies the type of one component as follows: 


0x00 | video 
0x01 | audio 
Oxff | no component 


The first ThpComponents.numComponents entries of ThpComponents.componentTypes are valid. For 
each component, an information structure is stored after the ThpComponents struct. 


15.34.3 VideoInfo Structure 


Component type 0 is video, a ThpVideolInfo struct looks like this: 


start | end | size | description 

0x00 | 0x03 4 width 

0x04 | 0x07 4 | height 

0x08 | 0x0b 4 unknown (only v1.1 files) 


15.34.4 AudiolInfo Structure 


Component type | is audio (not always included), a ThpAudioInfo struct looks like this: 


start | end | size | description 

0x00 | 0x03 4 numChannels 

0x04 | 0x07 4 | frequency 

0x08 | 0x0b | 4 | numSamples 

0х0с | OxOf 4 numData (only for v1.1 files) - amount of audio blocks stored after each video block 
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15.34.5 Frame data 


A frame is made up of a frame header followed by a video frame followed by ThpAudioInfo.numData 
audio frames (only if the video contains sound). 


The frame header consists of 3 (or 4, if the video contains sound) 32bit values: 


start | end | size | description 

0x00 | 0x03 4 nextTotalSize - total size of NEXT frame (frame header, video and audio) 

0x04 | 0x07 4 | prevTotalSize - total size of PREVIOUS frame 

0x08 | Ox0b | 4 | imageSize - size of image frame of THIS frame 

0х0с | OxOf 4 audioSize - size of one audio frame of THIS frame (only if the file contains audio) 


Directly after the frame header FrameHeader.imageSize bytes video information follow. Directly after the 
video information, ThpAudioInfo.numData audio frames follow, each Frameheader.audioSize bytes large 
(only if the file contains audio). 


15.34.6 Video Frames 


A video frame is more or less a jpeg image. A jpeg file is structured by several markers. A marker is a 
two-byte code, the first of the two bytes is 0хҒҒ. The jpeg standard states that if you want to store the value 
ОхЕЕ, you have to store it as Oxff 0x00 (else it would be confused with a marker). This is NOT the case 
in .thp files, the value 0x££ is stored simply as 0xff in the image data. So if you want to use jpeglib to read 
the frame, you have to convert ће thp "quasi-jpeg" to a real jpeg by converting 0xff values to ОхЕЕ 0x00 
in the image data. You have to be careful that you don't convert the terminating End-Of-Image marker, 
though. 


- search for Start-Of-Image marker (0хҒҒ 0хда) 
- search for End-Of-Image marker (0x££ 0xd9) (start search at end of buffer and search backwards!) 
- convert each 0xff between image data start and image data end to 0хҒҒ 0x00 


- the resulting buffer can be passed to jpeglib to let it decode the image for you 


15.34.7 Audio Frames 


An audio frame starts with a ThpAudioFrameHeader (total size is 80 bytes) 


start | end | size | description 

0x00 | 0x03 4 channelSize - size of one channel in bytes (*1) 

0x04 | 0x07 4 | numSamples - number of samples/channel 

0x08 | 0x27 | 32 | table for first channel (*2) 

0x28 | 0x47 | 32 | table for second channel (stored for one channel videos as well) (*2) 
0 

0 

0 


x48 | 0x49 2 signed value, channellPrev1 
x4a | 0х4р | 2 signed value, channell Prev2 
x4c | 0х4а | 2 signed value, channel2Prev 1 
Ox4e | Ox4f | 2 signed value, channel2Prev2 


(*1) audio frame size = sizeof (ThpAudioFrameHeader) + ThpAudioInfo.numChannels * ThpAudioFrameHeader. 
(*2) tables stored as 16bit signed 5.11 fixed point numbers 


Directly after the ThpAudioFrameHeader ThpAudioFrameHeader.channelSize bytes follow for the first 
channel, and if the video is stereo (ThpAudioInfo.numChannels = 2), that many bytes follow for the second 
channel. 


The audio data is made up of small packets of 8 byte, each packet contains 14 samples. Some kind of 
adpcm coding is used. A sample is calculated like this: 
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newSample = previousSample*factorl + sampleBeforePreviousSample*factor2 + (sampleData 
* 2^exponent); 


For each packet, the first byte stores factor1, factor2 and exponent: 
u8 index = (firstByte >> 4) & 0x7; //highest bit of byte is ignored 


u8 exponent = firstByte & Oxf; 


float factorl ThpAudioFrameHeader.table[2*index]/pow(2.f, 11); 


float factor2 ThpAudioFrameHeader.table[2*index + 1]/pow(2.f, 11); 


The following 7 bytes store 14 sampleData (each 4 bit, interpreted as a signed two's complement number). 


15.35 TPL (Texture Palette) 


Another custom GameCube file format that holds texture and texture palette data. Many textures can be 
stored in one TPL file format, and it is commonly used by the SDK to hold texture data for GameCube 
games. 


note: appearently there are different formats of .TPL files, the following applies only to those with the 
magic 0x00, 0x20, 0xa£, 0x30. 


TPL Header 


start end size | description | 
0х0000 | 0x0003 4 Magic (0x00, 0x20, ОхАЕ, 0x30) | 


0х0004 | 0х0007 4 ntextures - Number of Textures in File 
0x0008 | 0x000b 4 size of Header (always 0x0c in files with this structure) 


TPL Texture 


After the header goes 'ntextures' times the TPLTexture structure: 


start | end | size | description 
4 Texture Header Offset 
4 Texture Palette Offset (0 if no palette) 


TPL Texture Header 


For every texture at position ' Texture Header Offset’ there is the TPL Texture Header: 
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start | end | size 


description 


height 


width 


format 


© 


14 (4 bit intensity, 8x8 tiles) 


18 (8 bit intensity, 8x4 tiles) 


ТАА (4 bit intensity with 4 bit alpha, 8x4 tiles) 


ТА8 (8 bit intensity with 8 bit alpha, 4x4 tiles) 


RGB565 (4x4 tiles) 


RGB5A3 (*) (4x4 tiles) 


RGBAS (4x4 tiles in two cache lines - first is AR and second is GB) 


CI4 (4 bit color index, 8x8 tiles) 


\O} CO} D] NY BY] шор N| =| 


CI8 (8 bit color index, 8x4 tiles) 


10 | СПАХ2 (14 bit color index, 4x4 tiles) 


14 | СМР (S3TC compressed, 2x2 blocks of 4x4 tiles) 


offset to Texture Data 


wrap s 


wrap t 


min filter 


mag filter 


lod bias (float value) 


edge lod 


min lod 


max lod 


=| =|= =| A AIAI AIA A 


unpacked 


TPL Palette Header 


For every palette (not every texture has one) there is the TPL Palette Header: 


start | end | size 


description 


2 


nitems 


unpacked 


pad 


1 
1 
4 


format 

0 | IA8 | 
1 | RGB565 | 
2 | КОВ5АЗ (*) | 


4 


offset to Palette Data 


(*) RGB5A3 is RGB5 if color value is negative and RGB4A3 otherwise. 


15.36 YMP (height map) 
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16 Compression Formats 


16.1 Үау0 


This format is used to store the fonts in the BIOS/IPL. It is compressed similar to the the Zelda 64 ' YazO' 
compression. 


16.1.1 compression 


start | end | size | description 
0x0000 4 “Үау0” signature 
0x0004 4 size of decoded data in bytes 
0x0008 4 offset to link table 
0x000c 4 offset to non-linked chunks and count modifiers table 
0x0010 packed data (32 bit words) 


4 


he packed data is a bitstream (padded to a multiple of 32bits), with each bit having the following meaning: 


linked chunk, copy block from the link table (offset 0x0008) 


1 | non linked chunk, copy next byte from non-linked chunks and count modifiers table (offset at Ох000с) 


todo 


16.1.2 de-compression Code 


void Decode(void *s, void *d) 

{ 

132, Уу kG 

132 р, 9; 

132 cnt; 

і = r21 = *(u32 *) (5 + 4); // size of decoded data 
ј = 129 = %(132 *) (5 + 8); // link table 

К = r23 = *(u32 *)(5 + 12); // byte chunks and count modifiers 
а = ҮЗІ = 0; // current offset in dest buffer 
cnt = r28 = 0; // mask bit counter 

р = r24 = 16; // current offset in mask table 
do 

{ 

// if all bits are done, get next mask 

if(cnt == 0) 

{ 

// read word from mask data block 

22 = * (032 *)(s + p); 

р t= 4; 

cnt = 32; // bit counter 

} 

// if next bit is set, chunk is non-linked 
if(r22 в 0x80000000) 

{ 

// get next byte 

%(18-%)(а tq) = *(u8 *)(s * k); 

k++; а++; 
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} 

// do copy, otherwise 
else 

{ 

// read 16-bit from link table 
r26 = *(ul6 *)(s + 4); 
3 t= 2; 

// 'offset' 

r25 =q - (r26 & Oxfff); 
// ' count' 

r30 = r26 >> 12; 

if(r30 == 0) 

{ 

// get ‘count’ modifier 
£5 c (us. *) (5+ ky; 
ktt; 

r30 = r5 + 18; 

} 

else r30 += 2; 

// do block copy 

го = а + r25; 

Ғог (1=0; i«r30; i++) 

{ 


* (18 *) (ата) = * (18 *) (55 - 1); 


а; г5++; 

} 

} 

// next bit in mask 
r22 <<= 1; 

cnt--; 

) while(q < i); 

} 
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16.1.3 Font Data 


start | end | size | description 
0x0000 2 Font Type 
0x0002 2 first Character in Font 
0x0004 2 last Character in Font 
0x0006 2 Character to use for substituting invalid Characters 
0x0008 2 ascent Units 
0x000a 2 descent Units 
0x000c 2 width of widest Character 
0x000e 2 leading Space 
0x0010 2 Cell width 
0x0012 2 Cell Height 
0x0014 4 Texture Size 
0x0018 2 Texture Format 
0x001a 2 Texture Columns 
0x001c 2 Texture Rows 
0x001e 2 Texture Width 
0x0020 2 Texture Height 
0x0022 2 offset to Character-width Table 
0x0024 4 offset to Tile-Data 
0x0028 4 Tile-Data Size 
16.2 Yaz0 


Үа20 compression is reportedly used in quite a few Nintendo datafiles. I have seen it in SuperMario 
Sunshine's .szs files for example, and I heard that it is used in Windwaker and Majoras Mask as well. 


The first 16 bytes of a Yaz0-compressed data block are the data header. The first 4 bytes of the header are 
'Y',72/, "Z7, 0”, so you can easily see in your hex editor that there's a YazO block waiting for you :-) The 
second 4 bytes are a single uint32 (big-endian of course) that tells you the size of the decompressed data, 
so you know how large your working buffer has to be. The next 8 bytes are always zero. 


Next comes the actual compressed data. Үа20 is some kind of RLE compression. You decode it as follows: 
First you read a "code" byte that tells you for the next 8 "read operations" what you have to do. Each bit 
of the "code" byte represents one "read operation" (from left to right, that is, Ox80 first, 0х01 last). If the 
bit is 1, copy one byte from the input buffer to the output buffer. Easy. If the bit is 0, things are a little bit 
more complicated, RLE compressed data is ahead. You have to read the next two bytes to decide how long 
your run is and what you should write to your output buffer. 


15 8/7 0 
a b 


The upper nibble of the first byte (a) contains the information you need to determine how many bytes you're 
going to write to your output buffer for this "read operation". if a == 0, then you have to read a third byte 
from your input buffer, and add 0x12 to it. Otherwise, you simply add 2 to a. This is the number of bytes 
to write ("count") in this "read operation". byte2 and the lower nibble of bytel (b) tell you from where to 
copy data to your output buffer: you move (dist = (b < < 8)|byte2 + 1) bytes back in your outputBuffer and 
copy "count" bytes from there to the end of the buffer. Note that count could be greater than dist which 
means that the copy source and copy destination might overlap. 


16.2.1 de-compression Code 


//src points to the yaz0 source data (to the "real" source data, not at the header!) 
//dst points to a buffer uncompressedSize bytes large (you get uncompressedSize from 
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//the second 4 bytes in the Yaz0 header). 


void decode(u8* src, u8* dst, int uncompressedSize) 
{ 

int srcPlace = 0, dstPlace = 0; //current read/write positions 
u32 validBitCount = 0; //number of valid bits left in "code" byte 
u8 currCodeByte; 

while(dstPlace < uncompressedSize) 

{ 

//read new "code" byte if the current one is used up 
if(validBitCount == 0) 

{ 

currCodeByte = src[srcPlace]; 
++srcPlace; 

validBitCount = 8; 

} 

if ((currCodeByte & 0x80) != 0) 

{ 

//straight copy 

dst [dstPlace] = src[srcPlace]; 
dstPlacett+; 

srcPlacett; 

} 

else 

{ 

//RLE part 

18 bytel = src[srcPlace]; 

18 byte2 = src[srcPlace + 1]; 

srcPlace += 2; 

u32 dist = ((bytel & OxF) << 8) | byte2; 
u32 copySource = dstPlace - (dist + 1); 
u32 numBytes = bytel >> 4; 

if (numBytes == 0) 

{ 

numBytes = src[srcPlace] + 0x12; 
srcPlacett; 

} 

else 

numBytes += 2; 

//сору run 

for(int i = 0; i < numBytes; ++1) 

{ 

dst[dstPlace] = dst[copySource]; 
copySourcet*; 

dstPlacet*; 

} 

} 

//use next bit from "code" byte 
currCodeByte <<= 1; 

validBitCount-=1; 

} 

} 
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17 Graphic Formats 


171 YCbYCr 


This is the Format used for image data in the external framebuffer (XFB). It exploits the fact that the res- 
olution of color on a PAL/NTSC screen is lower than the resolution of luminance (brightness), and thus 
stores only separate luminance info for each pixel and combines the color information of two pixels each, 
saving 2 bytes versus traditional RGB-per-pixel framebuffers. This means that in XFB you cant modify 
the color of a single pixel without affecting its neighbour. (you can however, seperatly modify its lumi- 
nance/brightness). It also means that you can not accurately convert one single pixel into XFB framebuffer 
format, you will always have to convert two pixels at once. 


To convert two pixels to YCbYCr, first average their RGB values 


В = (R1*R2)/2 
б = (G1+G2) /2 
В = (B1+B2) /2 


now calculate the luminance portion of each pixel 


Ү1 (77/256)R1 + (150/256)G1 + (29/256)B1 
Y2 = (77/256)R2 + (150/256)G2 + (29/256) B2 


then calculate the combined color portion 


Cb 
Cr 


-(44/256)R - (87/256)G + (131/256)B + 128 
(131/256)R - (110/256)G - (21/256)B + 128 


now a 32 bit value to be written to XFB (to a 32 bit aligned address of course) can be made up like 
this 


31 24 | 23 16 | 15 8 | 7 0 
1111 1111 | 6556 bbbb | 2222 2222 | rrrr rrrr 


bit(s) description 

24-31 | 1 | Y1 - luminance Portion of first Pixel 

16-23 | b | Cb- combined color 

8-15 | 2 | Y2- luminance Portion of first Pixel 
0-7 r | Cr- combined color 


converting a single pixel back to RGB looks like this 


В = У+ 1.371(Cr - 128) 
С =У - 0.698(Cr - 128) - 0.336(Cb - 128) 
B= У + 1.732(Cb - 128) 
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17.2 14 (4bit indexed) 

17.3 ТА4 (4bit indexed with alpha) 

17.4 18 (8bit indexed) 

17.5 ТАЗ (8bit indexed with alpha) 

17.6 CIA (compressed 4bit indexed) 

177 CIA4 (compressed 4bit indexed with alpha) 


17.8 CI8 (compressed 8bit indexed) 


Used for Icons and Banners on Memory Card. This Format uses a palette in RGB5A1 Format, the Pixel 
data is stored in 8x4 pixel tiles. 


17.9 CIA8 (compressed 8bit indexed with alpha) 


17.10 RGB4A3 


Used for Icons and Banners on Memory Card. This Format uses no palette and is stored in 4x4 pixel tiles. 


17.10.1 RGB4A3 Pixel Format 


15 87 0 
.ttt rrrr | gggg  bbbb 
bit(s) description 

15 unused (?) 
12-14 | t | transparency 
8-11 | r | red channel 

4-7 р | green channel 

0-3 b | blue channel 


17.11 ВСВ5А1 


Used for Icons and Banners on Memory Card. This Format uses no palette and is stored in 4x4 pixel tiles. 


17.111 КСБ5АІ Pixel Format 


15 8117 0 
trrr  rrgg | gggb  bbbb 


bit(s) description 
15 t | transparency 

10-14 | r | red channel 
5-9 | g | green channel 
0-4 b | blue channel 
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17.12 RGB565 


17.121 RGB565 Pixel Format 


15 8 | 7 0 
rrrr 1994 | gggb  bbbb 


bit(s) description 

11-15 | r | red channel 
5-10 | g | green channel 
0-4 b | blue channel 


17.13 RGBAS 


17.131 RGBAS Pixel Format 


31 24 | 23 16 | 15 8 |7 0 
rrrr rrrr | 9999 94999 | bbbb bbbb | aaaa аааа 
bit(s) description 
24-31 | г | red channel 
16-23 | g | green channel 
8-15 b | blue channel 
0-7 a | alpha channel 
17.14 S3TC 


WARNING: this section is screwed! any advice/corrections/help/etcblabla welcomed! (thanx to Aaron 
Kaluszka for pointing this out) 


S3TC is a compression method for textures, developed by 53 and licenced by Nintendo for the Game- 
cube (and also by Microsoft for DirectX 6.0). It basically gives you one more MIP level for free, with 
relatively small quality loss and a simple implementation in hardware. You basically store 2 colour values 
and then you have a few bits per pixel to interpolate between them. It works in blocks of 4x4 pixel. 


There are 5 variants: 


DXT1 allows one bit of alpha 
DXT2/3 allows 4 bits of alpha 
DXT4/5 stores 2 alpha values and has 3 bits to interpolate between them 


The difference between DXT2/3 and 4/5 is, if colour values are pre-multiplied with alpha. The blend- 
ing equation is normally (c*(1-a))+(t*a)), so with pre-multiplied alpha the texture contains (t*a) in each 
colour channel and the blending becomes (с*(1-а) + t). 
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Each image is made up of tiles placed linearly from left to right then top to bottom. 
Each tile is made up of 4 blocks 


01 
23 


Each block is made up of 8 words. 4These 8 words represent 16 pixels using S3TC compression. 
RRRRRGGG - GGGBBBBB - rrrrrggg - gggbbbbb - 00112233 - 44556677 - 8899UUVV- WWXXYYZZ 


К = Color 0 Red 

G = Color 0 Green 

B = Color 0 Blue 

т = Color 3 Red 

g = Color 3 Green 

b = Color 3 Blue 

0 - 9, U - Z = Pixel color (2-bits each) 

Colors | and 2 are interpolated from colors 0 and 3 


The tiles are 32 bytes each. Depending on the image format the width and height of the tiles will dif- 
fer. A 16bit format (ie RGB5 or RGB4A3) will have a 4x4 pixel tile since 4 * 4 * 2 bytes = 32. An 8bit 
format (ie Color Indexed) will have a 8x4 pixel tile since 8 * 4 * 1 byte = 32. 


So a 32x32 image (like a memory card icon) that is in RGB5 format would be 8 tiles across and 8 tiles 
down. 


17.141 CMPR 


Like a usual texture, a CMPR-texture is divided on tiles, each 32-bytes to fit a texture cache line. Every tile 
is sub-tiled into four parts, in zigzag order : 


011 
24118 


The format of the sub-tiles is pretty simple, and looks like DXT1. First two base colors in RGB565, 
followed by 16 sub-tile texels. Every texel is 2-bit wide, to lookup from four colors : 00, 01, 10 and 11. 
First two are given already, and last two are interpolated from first ones, by the following rule : 

COLORO and COLORI are base colors. 

RGBO <- unpack RGB565 COLORO 

AO = 255 

КОВ1 <- unpack RGB565 COLORI 


A] = 255 
if COLORO > СОГОВ1 


> RGB2 = 2 * RGBO + RGB1) / 3 
> А2-255 
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> RGB3 = (2 * КОВ1 + RGBO) /3 
> АЗ = 255 


else 


> RGB2 = (RGBO + RGB1)/2 

> А2-255 

> RGB3 = (2 * RGBI + RGBO) /3 
> АЗ-0 
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18 Appendix 


18.1 GCC Quick How To 
18.1.1 compile ASM to object: 


<DEVKITCUBE>/bin/powerpc-eabi-elf-as -c \ 
-І <DEVKITCUBE>/powerpc-eabi-elf/include -І <additional includes> \ 


testasm.s -o testasm.o 


18.11.2 compile С to object: 


«DEVKITCUBE»/bin/powerpc-eabi-elf-gcc -c \ 
-Т <DEVKITCUBE>/powerpc-eabi-elf/include -Т <additional includes> \ 


-nostdlib testc.c -o testc.o 


18.1.3 compile C++ to object: 


<DEVKITCUBE>/bin/powerpc-eabi-elf-g++ -c \ 
-Т <DEVKITCUBE>/powerpc-eabi-elf/include -Т <additional includes> \ 


-nostdlib -fno-exceptions testcpp.cpp -о testcpp.o 


18.1.4 link objects 


«DEVKITCUBE»/bin/powerpc-eabi-elf-ld -T ppc-ngcbin.x -o test.elf crt0.o \ 
«DEVKITCUBE»/lib/gcc-lib/powerpc-eabi-elf/3.3/crtbegin.o ^ 


«DEVKITCUBE»/lib/gcc-lib/powerpc-eabi-elf/3.3/crtend.o ^ 
testasm.o testc.o testcpp.o -lg -lstdc++ -lm -lc -lnosys 
you only need to link against crtbegin.o/crtend.o if you are using c++, and you only need -lg,-Istdc++,- 


lc,-Im if you are actually using these libraries (of course:)). however if you do so, linking against -Inosys 
as well is essential. 


18.1.5 remove unneeded sections (debug info etc) from object 


<DEVKITCUBE>/bin/powerpc-eabi-elf-strip -s test.elf 


18.1.6 convert object to plain binary 


<DEVKITCUBE>/bin/powerpc-eabi-elf-objcopy -0 binary test.elf test.bin 


18.1.7 convert absolute address into filename/line number/function 
compile with "-g" flag, then use 


«DEVKITCUBE»/bin/powerpc-eabi-elf-addr2line -f -e test.elf 0x80003100 
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18.1.8 Building a Crosscompiler 


configure options: 


--target-powerpc-eabi-elf 
--with-cpu-750 
--disable-threads 
--enable-languages-c 
--disable-shared 
--disable-nls 


--with-newlib 


18.1.9 Linker Script 


to do 


18.1.10 Startup Code 


to do 


18.2 Boot Process Details 


The IPL (Initial Program Loader), or Bootrom, is located inside one Macronix chip (near Flipper, U10) and 
connected to the EXI bus. When the Gamecube is powered on, bit 25 (IP) in the Machine State Register 
is set, which means the system exception vector offset is 0x£££00000. Then a small (about 0x0700 bytes) 
program called 'BS' will be mapped to 0x£££00100 (the hardware reset vector) and control will be returned 
to the Gamecube like after a normal reset, which means 'BS' will be started. 


18.2.1 BS - Bootstrap 1 
> copies the Bootstrap 2 code (BS2) from Bootrom to 0x81300000 
> disables the IPL decryption logic by clearing bit 17 of 0xcc006800 
> sets IP of Machine State Register so exception vectors are pointing to lower memory 


> jumps to BS2 code 


18.2.2 BS2 - Bootstrap 2 


BS2 is the Program that loads the game or shows the menus when the gamecube has been powered on with- 
out a game inserted. It was written in C, using official SDK libraries, probably earlier than 1.0. — start.c 
seems to be same as usual, except that there is no OSInit() call (old versions must call OSInit() in main, 
instead of — start). 


note: this has been reversed from a PAL gamecube and looks different on a NTSC one. 
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18.2.2.1 short description of start() routine. 

// 81300000 

є Start; 
__init_registers() // set stack pointer and static bases (r2, r13) 
. init hardware() // paired-singles and cache init 
. init data() // clear bss ? 


// here goes Debug Monitor stuff 


DBInit() // debug monitor init :) 
. init user() // cpp init 
main() // that's actually, IPL (BS2) code 


jmp exit() // halt CPU 


18.2.2.2 IPL main() reversing 
// 813006D4 
main() 
{ 

BS2Init(); 

OSInit(); 
AD16Init (); 
AD16WriteReg (0x800); 
DVDInit (); 
AD16WriteReg (0x900); 


CARDInit (); 


AD16WriteReg(0xa00); 
0x81302104(); // SRAM, real-time clock (check ?) 
. VIInit(0); 


МЕТА: ()5 


AD16WriteReg(0xb00) ; 

0x813004e4(); // setup performance. monitor 

0x8130222c(); // update time-base by SRAM clock 

0x813022c0(); // perform initial DVD actions and fall back into menu 
PADSetSpec(5); // sed PAD type ('spec') to 'production’ 

PADInit (); 

AD16WriteReg(0xc00); 


BS2Menu(); // here goes intro and main menu... (BIG one!) 
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OSPanic( FILE , 


) 
float NaN; 
// 8130045C 

void BS2Init () 
{ 


// clear LoMem and OSMem 
0, 
0, 


memset (0x80000000, 
memset (0x80003000, 


BATInit (); 


// set memory size to 24MB 


*0x80000028 = 0x01800000; 


ГА 


256); 
256); 


"BS2 ERROR >>> SHOULD NEVER REACH HERE") ; 


// set console type to default retail 1 


*0x8000002c = 1; 
// upgrade retail 


*0x8000002c += *0хсс00302с >> 28; 


(u32)NaN = -1; 
FPUInit (); 

} 

// 813003A0 


void BATInit () 


ntspr DBAT 


r4 
r4 
r4 
r4 
r4 
r4 
r4 
r4 


r4 


r4 
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} 

// 813003D8 
void FPUInit () 
{ 


// ЕРО already initialized in __start(), 


// so just invalidate all FPRs. 


. asm 


lfs Е0, NaN 
fmr f1, f0 
fmr f2, ЕО 
fmr f3, f0 


) 
// maybe later 
0x81302104 () 
{ 
. OSLockSram(); 
. OSCheckSram(); 
__OSGetRTC () ; 
OSTickToCalendarTime(); 
memset () ; 
. OSUnlockSram(); 
. OSSyncSram(); 
) 
// maybe later 
0x813004e4 () 
{ 
OSDisableInterrupts(); 
OSGetTick () ; 
OSGetTick () ; 
OSGetTick () ; 
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- div2i(); 
- div2i(); 


PPCMtpmcl (); 
PPCMtmmcr0 (); 
OSGetTick(); 
OSGetTick(); 


PPCMtmmcr0 (); 


PPCMfpmcl (); 


—div2i(); 
—div2i(); 
—div2i(); 


OSRestoreInterrupts (); 
} 
// maybe later 
0х8130222с 0 
{ 
. OSLockSram(); 
__OSGetRTC () ; 
. OSSetTime(); 
. OSUnlockSram(); 
) 
static int BS2State = 0; 
// just layer.. 
0x813022c0 () 
{ 
BS2State = BS2Mach(); 
} 
// 81300A70 
// located in _FILE__ = "BS2Mach.c" 
int BS2Mach () 
{ 
static int state = 0; 


BOOL level = OSDisableInterrupts(); 


switch (state) 


case 0: 


[r13 - 0x7dc8] = 0х800030а4; 
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state = 1; 
case 1: 
. OSGetSystemTime(); 
some checks 
if(fail) break; 
state = 2; 
// Install DVD cover callback 
case 2: 
if([rl3 - 0х7аа8] == 0) 
{ 
r3 = [r13 - 0x7dc8] 
[r3] = 0 
[r13 - 0x7dc4] = 0 


[r13 - 0x7dac] 1 
DVDLowSetResetCoverCallback (0); 
DVDReset () ; 

[r13 - 0x7da8] = 1 
(564) [r13 - 0x7d9c] = __OSGetSystemTime (); 
break; 

} 

__OSGetSystemTime (); 


if(fail) break; 
DVDLowSetResetCoverCallback (0x813007d8) ; 
DVDReset () ; 
state = 3; 
// Read Disk information (ID) 
case 3: 
DVDReadDiskID (0x8145e620 + 64, 0х80000000, 0x813007e4) ; 
state = 4; 


break; 


// Leave immediately ? 
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case 16: 


break; 


default: 


} 


OSPanic( FILE , 


LINE , "BS2 ERROR >> UNKNOWN STATE"); 


OSRestoreInterrupts (level); 


return 


) 


// 81301154 


void BS2Menu() 


{ 


BS2InitAlloc(); 


) 


static OSHeapHandler BS2Heap; 


// 81307EA8 


void BS2InitAlloc() 


{ 


18 *arenaLo; 


18 *arenaHi; 


18 *arenaNew; 


arenaHi 


arenaLo = OSGetArenaLo(); 


OSGetArenaHi (); 


arenaNew = OSInitAlloc (0х8 


tArenaLo(arenaHi); 


BS2Heap = OSCreateHeap (are 


OSSe 


tCurrentHeap (BS2Heap) ; 


OSAddToHeap (BS2Heap, arena 


BS2C 
} 


heckAlloc(); 


// 81307F34 


void BS2CheckAlloc() 


{ 


OSCheckHeap (BS2Heap) ; 


} 


// 81307F58 


(DVDLowGetCoverStatus() == 1) ? 19: step; 


arenaLo = (void *)OSRoundUp32B (arenaLo) ; 


arenaHi = (void *)OSRoundDown32B (arenaHi); 


0800000, arenaHi, 2); 


naLo, arenaHi); 


ew, 0x81100000); 
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void *OSAlloc(long size) 
{ 

void *ptr; 

if((ptr = OSAlloc(size)) == 0) 

{ 

OSPanic(?); 
} 


return ptr; 
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18.2.2.3 Map of IPL Library code 


Address Name Libray 
0x813014C8 | DEMOIntt (*) DEMO 
0x81307F58 | OSAlloc (*) OS 
0x813327BC | PPCMtmmcrO 
0x813327C4 | PPCMfpmcl 
0x813327CC | PPCMtpmcl 
0x81332814 | OSInit OS 
0x81332EFO | OSInitAlarm OS 
0x81332F3C | OSCreateAlarm 
0x81333688 | OSAllocFromHeap 
0x81333784 | OSSetCurrentHeap 
0x81333794 | OSInitAlloc 
0x81333804 | OSCreateHeap 
0x81333870 | OSAddToHeap 
0x813338D0 | OSCheckHeap 
0x813344C0 | OSGetStackPointer 
0x8133491C | OSReport 
0x8133499C | OSPanic 
0x81334AA4 | PPCHalt 
0x81334D4C | EXIImm EXI 
0x81335134 | EXISync 
0x813353C8 | EXIProbeReset 
0x8133570C | EXISelect 
0x81335838 | EXIDeselect 
0x81335D6C | EXILock 
0x81335E60 | EXIUnlock 
0x81335F54 | AD16Init 
0x81336090 | AD16WriteReg 
0x813361B0 | OSDisableInterrupts 
0x813361C4 | OSEnableInterrupts 
0x813361D8 | OSRestoreInterrupts 
0x81336DD8 | | OSGetRTC 
0x813372B0 | | OSLockSram 
0х81337658 | _ OSUnlockSram 
0x813376A0 |  OSSyncSram 
0x813376B0 | _ OSCheckSram 
0x81338504 | OSInitThreadQueue 
0x8133939C | OSGetTick 
0x813393B8 |  OSSetTime 
0x8133943C | _ OSGetSystemTime 
0x8133963C | OSTicksToCalendarTime 
0x8133AC50 | DVDLowGetCoverStatus DVD 
0x8133AB18 | DVDLowReset 
0x8133ABD4 | DVDLowSetResetCoverCallback 
0x8133B5F0 | DVDInit 
0x8133CD18 | DVDReadDiskID 
0x8133D0EC | DVDReset 
0x8133DBEO | __VIInit VI 
0x8133DDC8 | МП 
0х8133Е6С0 | VIConfigure 
0x8133F0B4 | VIGetTvFormat 
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Address Name Libray 
0x8134052c | PADInit PAD 
0x8134092c | PADSetSpec 
0x81343114 | CARDInit 
0x813480D4 | GXInit 
0x81349148 | GXInitFifoBase 
0x81349230 | GXSetCPUFifo 
0x81349340 | GXSetGPFifo 
0x813494B8 | __GXFifolnit 
0x8134B0AC | __GXPEInit 
0x8135A178 | _ div2i gcc 
0x8135A394 |  mod2i gcc 
0x8135B494 | vprintf stdlib 


(*) these functions were slightly modified for the IPL. 


18.2.3 Apploader 
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The Apploader provides functions to the bootrom that load the game (using bootrom read DVD functions). 
The bootrom calls the Init function, then the Main function in a loop, then the Closing function. At first, 


the BIOS calls the Apploader entrypoint with r3, r4, and r5 pointing to a free space for a 32 bit value. 


// 
// 
// 
// 
// 
// 
// 
// 
// 
// 
// 


info based on Luigi Mansion appldr.bin file 

(built date is 17 Dec 2001). 

Apploader Entrypoint 

Input values : 

r3 = Address where to put the address of the Init function 

r4 = Address where to put the address of the Main Loading function 
r5 = Address where to put the address of the Closing function 
Return values : 

none 

file: [0010-0013] = 0x81200288 (apploader entrypoint) 


void Entrypoint(r3, r4, r5) 


0x81200290 // Init 
0x81200580 // Main 
0x81200D50 // Close 


// Init function 


// Input values : 


// 


? 
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// 
// 


Return values 


none 


void Init (void (*OSReport) (char *fmt, ...)) 


{ 


} 

// 
// 
// 
// 
// 
// 
// 
// 
// 
// 
// 
// 
// 


// clear some important memory areas 

memset (OSAppLdr + 32, 0, 32); 

memset (&OSAppLdr.DollImage, 0, sizeof (DolImage) ); 
+0x140] = 0 


OSAppLdr.pass = 0 


+0x148] = 0 
OSAppLdr.OSReport = OSReport // save report callback 


OSAppLdr.OSReport ("Apploader Initialized. $ Revision: 28 $\n"); 


OSAppLdr.OSReport ("This Apploader built $s %s\n", __DATE_, TIME 


Main Loader function 


Input values : 


r3 = Address where to put the Memory destination of the disk read 


r4 Address where to put the Size of the disk read 


rb = Address where to put the Starting position of the disk read 


Return value: 
r3 = 0 if everything is already loaded 


= 1 (or !=0) if main function should be called again 


at 0x81200580 


helper functions (below) 


u32 DOLSize(void); 


// 


0x812013E0 seems to be a big structure, like that 


struct OSAppLdr 


{ 


// untouched 

u32 SecondTimeForThePart; 

u8 [28] 

u8 [32] // "BB2" structure ? 

DolImage Dollmage; // main DOL executable header 


// flags or something 
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u32 +0x140 
u32 pass; // 0...12 
u32 +0x148 


// report routine itself is placed somewhere іп bootrom 


void (*OSReport) (char *fmt, ...); 
// flags or something 
132 %0х150 
132 %0х154 
132 %0х158 
132 %0х15С 
18 [32] 
} OSAppLdr; // 0x174 total 
int Main(r3, r4, r5) 


{ 
int pass = OSAppLdr.pass; 
if(pass <= 12) 
{ 
switch (pass) 
{ 
// read "BB2" structure (DVD offset at 0x0420) 
case 0: 
case 1: 
// "BB2" structure ? 
// 0420-0424 offset of main executable DOL 
// 0424-0427 offset of the FST 
// 0428-042B size of FST 


// 042C-042F maximum size of FST 


[r3] = OSAppLdr + 32 
[r4] = 32 
[r5] = 0x420 


OSAppLdr.pass = 2 

DCInvalidateRange([r3], [r4]) 
break; 
// check "BB2" structure FST sizes 


case 2: 


FSTLength = [OSAppLdr + 32 + 8] 


FSTMaxLength = [OSAppLdr + 32 + 12] 
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if (FSTLength > FSTMaxLength) 

{ 
OSAppLdr.OSReport ( 
"APPLOADER ERROR >>> FSTLength(%d) in BB2 is greater V 
than FSTMaxLength (£d) An", FSTLength, FSTMaxLength); 
PPCHalt (); 


} 


[r3] = OSAppLdr + 0x160 
[r4] = 32 
[r5] = 0x440 


OSAppLdr.pass = 3 
DCInvalidateRange([r3], [r4]) 
break; 
case 3: 
[0x800000E8] = [OSAppLdr + 0х160] // word 
break; 
case 4: 
// load main DOL header (256 bytes) 
case 5: 
[r3] = &OSAppLdr.DolImage 
[r4] = 256 


[r5] = [OSAppLdr + 32] // from BB2 
OSAppLdr.pass = 6 
DCInvalidateRange([r3], [r4]) 
break; 
case 6: 
totalSize = DOLSize(); 
maxSize = [[800000F4] + 0x28]; // PadSpec ? 
if((totalSize > maxSize) && maxSize) 
{ 
OSAppLdr.OSReport ( 
"APPLOADER ERROR >>> Total size of text/data sections \ 
of the dol file are too big (%d(0x%08x) bytes). Currently \ 
the limit is set as %d(0x%08x) bytes\n", totalSize, maxSize); 


PPCHalt (); 
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case 7: 
case 8: 
case 9: 
case 10: 
case 11: 
case 12: 

if (SecondTimeForThePart == TRUE) 

{ 

OSAppLdr.OSReport ( 


"Failed assertion SecondTimeForThePart == TRUE"); 


PPCHalt (); 


else 


return 0; 


} 
// helper functions 
// at 0x81200338 
u32 DOLSize (void) 
{ 
Dollmage *dol = &OSAppLdr.Dollmage; 
u32 totalBytes = 0; 
int i; 


for(i-0; i«DOL MAX TEXT; 1++) 


if (dol->textData[i]) 
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// aligned to 32 byte boundary 


totalBytes += (dol->textLen[i] + 31) & ~31; 


for(i-0; i«DOL MAX DATA; 1++) 


if (dol-»dataData[i]) 


// aligned to 32 byte boundary 


totalBytes += (dol->dataLen[i] + 31) & -31; 


} 

return totalBytes; 
} 
// Closing function 
// 
// Return value: r3 = entry point 
// 
// at 0x81200D50 


132 Close (void) 
{ 


// provide entrypoint of main DOL executable to IPL 


return OSAppLdr.DollImage.entry; 


18.2.4 Main DOL executable 
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18.3 Game and Maker Codes 


18.3.1 Gamecodes 


offset | size | Description 


1 1 System ID 


value | id | Description 

0x47 | G | Gamecube (standard value) 

used by Legend Of Zelda: Ocarina Of Time (Master Quest) 
Might be a indicator for emulated/ported/promotional titles. 
0x55 | U | used by GBA-Player Boot CD 


0x44 D 


2-3 2 Game ID/serial Number 


4 1 Country/Region Code 
value | id | Country 
0x45 | E | USA/NTSC 
0x50 | P | Europe/PAL 
0х4а | J | Japan/NTSC 
0x55 | U | used by the European version of The Legend Of Zelda: Ocarina Of Time (Master Quest) 


18.3.3 Game Serial ID 


Characters | Description 


3 System ID 'DOL 
4 Gamecode 
3 Country ID 

ID | Country 


USA | guess what :) 

NOE | Nintendo of Europe 
NOA | Nintendo of America 
? Japan 


for example 


> DOL-GZLE-USA (Zelda) 
[> DOL-GNHE-USA (NHL Hitz 20-20) 


> DOL-GTEP-NOE (10801 Avalanche) 


18.3.3 Makercodes 


The ID (2 Bytes ASCII) belongs to the publisher, not the developer. Hence, even though Rare developed 
Star Fox Adventures, and Retro Studios developed Metroid Prime, they both have the Vendor ID of Nin- 
tendo (01). 

It is unknown how vendor IDs are allocated; However, all IDs thus far seem to be alphanumeric. If this 
is accurate, then as a result the maximum number of unique vendors is 1,296. Vendor IDs seem to be 
region-independent. 
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ID | Vendor 
01 | Nintendo 
08 | Capcom 
41 | Ubisoft 

4F | Eidos 

51 | Acclaim 
52 | Activision 
5D | Midway 
5G | Hudson 


64 | Lucas Arts 


69 | Electronic Arts 


6S | TDK Mediactive 


8P | Sega 

A4 | Mirage Studios 
AF | Namco 

B2 | Bandai 

DA | Tomy 


EM | Konami 
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18.4 Macronix Chip IDs 


X ff tmbprs 
MX | MX’, vendor id 
ff | 2 digits, device family 
17 | auto focus controller 
23 | mask rom 
25 | spi serial flash memory 
26 | mtp eeprom 
27 | eeprom 
28 | flash memory 
29 | flash memory (single voltage) 
53 | memory card (smc) 
67 | flash memory 
69 | flash memory + sram (stacked chip) 
88 | digital camera/flat panel display controller 
89 | flat panel display controller 
92 | sound generator 
93 | single chip answering machine/digital recorder controller 
97 | isdn controller 
98 | network 
99 | bluetooth 
t 1 character, device type 
c | cmos 
f | flash 
1 | low-voltage 
w | srw 
у | 2.2v 
и | 1.8v 
x | 1.5% 
vw | 2.25v+srw 
mm | 2 to 4 digits, mode/density 
004 4M, x8 Boot Block 
040 4M, x8 Equal Sector 
400 | 4M, x8/x16 Boot Block 
b 1 character, bootblock type (rom only) 
t | top 
b | bottom 
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18.5 


X ff t mbprs 
1 character, package type 
р plastic dip 
plastic sop 
а plastic рісс 
t tsop normal 
d qeramic dip 
x8 | 0.8mm ball pitch, bga, csp 
X csp 
1 character, temperature range 
c | commercial 
i industrial 
m military 


1 character, speed 


45 | 45ns 
55 | 55ns 
70 | 70ns 
85 | 85ns 
90 | 90ns 
10 | 100ns 
12 | 120ns 
15 | 150ns 
20 | 200ns 
25 | 250ns 


chip simelarities 


> mx25LA001 (serial flash rom in nintendo memory card 59) 
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> datasheet was never available at Macronixá but take a look at their 3-volt SPI Flash ROMs (the 


MX25LXX02 series) for a general pinout withoutáthe Unknown pin 24. 


> mx25LA004 (serial flash rom in datel memory card) 


> mx25L4004 - 4Mbit, 4Mx1 serial flash rom (datasheet was, but is no longer available at 


Macronix :/) 


> mx98730ec (eth controller in bba) 


> 


> 


mx98728ec - single chip 10/100 base generic MAC interface 
(mx98726, mx98728) 


> Gekko 


> ibm PowerPc750CXe 
> (PowerPc740, PowerPc750, PowerPc750CX) 


> (inside flipper) 


> (big 222) mx92L832 - 32 poly phony sound generator 
> (big 222) mx96037 - 16bit DSP Controller 
> (mx93011a,...) 
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> mx 8013108-М rtnc-dol 11602221 (rtc/ipl) 
[> MoSys (MS3M23B-5 A) 12MB 1-T SRAM (main memory) 
> МЕС (D4891281G5 0125XU621) 16MB ARAM (auxiliary/dsp memory) 


18.6 Easter Eggs 


> To hear a different sound when the console boots hold the Z button down once you turn the console 
on and as the square bounces down you will hear the noises of kids. 


> Hold Z then about one second later hold A to hear another sound. 


> If you have 4 controllers (and 5 hands) this one will work: Before you turn the Gamecube on hold 
down Z on each controller, then turn the system on (with your 5th hand of course). You will be 
greeted by a ninja yell. 


> holding B on first controller, then powering on will let you switch a pal gamecube into 60Hz mode 
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19 References 


U.S. Pat. 5,680,534 (Video game/video graphics program fabricating system and method with su- 
perimpose control) 


U.S. Pat. 6,411,301; 6,452,600; 6,466,218; 6,697,074 (Graphics system interface) - GX Info 


U.S. Pat. 6,421,058 (Graphics command stream for calling a display object in a graphics system) - a 
lot of GX Info 


U.S. Pat. 6,424,348; 6,456,290; 6,489,963 (Application program interface for a graphics system) - 
GX Info 


U.S. Pat. 6,457,128 (Optical disk. An optical disk barcode forming method, an optical disk repro- 
duction apparatus, a marking forming apparatus, a method of forming a laser marking on an optical 
disk, and a method of manufacturing an optical disk.) 


U.S. Pat. 6,468,160 (Security system for video game system with hard disk drive and internet access 
capability) 

U.S. Pat. 6,591,019 (3D transformation matrix compression and decompression) 

U.S. Pat. 6,606,689 (Method and apparatus for pre-caching data in audio memory) - ARAM Info 
U.S. Pat. 6,609,977 (External interfaces for a 3D graphics system) - Lots of Register Info 


U.S. Pat. 6,618,048 (3D graphics rendering system for performing Z value clamping in near-Z range 
to maximize scene resolution of visually important Z components) 


U.S. Pat. 6,636,214 (Method and apparatus for dynamically reconfiguring the order of hidden surface 
processing based on rendering mode) - Some GX Stuff 


U.S. Pat. 6,639,595 (Achromatic lighting in a graphics system and method) - Some GX Info 


U.S. Pat. 6,580,430 (Method and apparatus for providing improved fog effects in a graphics system) 
some GX Info 


U.S. Pat. 6,643,744 (Method and apparatus for pre-fetching audio data) - Some ARAM Info 
U.S. Pat. 6,664,958 (Z-Texturing) - GX Info 

U.S. Pat. 6,664,962 (Shadow mapping in a low cost graphics system) - GX Info 

U.S. Pat. 6,707,458 (Method and apparatus for texture tiling in a graphics system) - GX Info 
U.S. Pat. 6,681,296 (Method and apparatus for software management of on-chip cache) 

U 


J.S. Pat. 6,700,586 (Low cost graphics with stitching processing hardware support for skeletal 
animation) 


с 


‚5. Pat. 6,701,424 (Method and apparatus for efficient loading and storing of vectors) 


U.S. Pat. 6,717,577 (Vertex cache for 3D computer graphics) 
Macronix Product Catalog 

mx98726 Datasheet 

mx98728 Datasheet 


mx25L4004 Datasheet 
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> PowerPC 740/PowerPC 750 RISC Microprocessor User's Manual 


> PowerPC 750CX/ 750CXe RISC Microprocessor User's Manual 


[> Standard ECMA-268 (80 mm DVD - Read-Only Disk) 


[> MN102H60G/60K/F60G/F60K LSI User Manual 


19.1 Sources 


ht 


ht 


ht 


ht 


ht 


ht 


tp://www.uspto.gov 
tp://www.macronix.com 
tp://www.ibm.com 
tp://www.s3.com/s3tc (no more available) 


tp://www.ecma-international.org/publications/standards/Ecma-268.htm 


tps://www.semicon.panasonic.co.jp 
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besides freely available datasheets and patents, this document was created based on information provided 
by the following people. if you think you are missing in this list, please keep me informed so i can add you 


immediately. 


titanik/crazy nation 


"Gamecube Low-level Info’ in CZN ’Gamecube Source pack #1’ 


duke/napalm 


duke@napalm-x.com 
initial "gcinfo.txt" 
some invaluable information (you know who you are) 


costis 


costis@gbaemu.com, gcdev.com http://www.gcdev.com 
hardware introduction text (posted on some website...uhm :)) 
gcspec.html 

additional info in sram checksum, video regs 


org 


kvzorganic@mail.ru 

additional apploader info / apploader RE 
IPL RE, boot process details 

info on Gekko specific opcodes 

tons of other info (cheers mate) 


torlus 


gcc config 


22? 


www.gc-nfo.com 
some file-format info 


Crowtrobo 


ctr-snd.txt 
memory card info 


Azimer 


http: //www.apollo64.com 
some additional VI info 


tmbinc 


debugmo.de http: //debugmo.de 

released some sources that helped to close the one or other gap 
driving force behind GX reversing 

IPL encryption reversing/IPL replacement info 


shagkur 


shagkur@gmx.net 
GX reversing, additional sources/infos 


Timothy Wilson 


theimp@iinet.net.au 
compiled some valuable info concerning memory cards 


Authors of GClib 


gclib.sf.net 
cross-checking against the Source helped to make sure no bad errors sneaked in 


GC-Linux Team 


gc-linux.sf.net 
another valueable source for code that has been cross-checked against 


Aaron Kaluszka 


megabyte@kontek.net 
some image format info 


Monk 


monk@mad.scientist.com 
TPL Fileformat details 


Steven Looman 


steventkrx.nl 
keyboard scancodes, comments on adapters 


thakis 


http: //www.amnoid.de/gc/ 
lots of additonal fileformat info, proofreading&spellchecking 


Alexander Wold (micropal) 


http://cube.iu.hio.no/~s104086/ 
additional rtc/ipl pinout info 


moreover, many thanks must go to everyone who helped making this document more consistant and er- 
ror free by proofreading and pointing out mistakes, in particular tmbinc, org, hubb, Aaron Kaluszka, 
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Skywalker, Jihad, xor37h, costis, CrowTrobo, mist, ionic, Briii, Desktopman, Spike Grobstein, Steven 
Looman, Anders Montonen, Monk, Josiah "afnom" Burroughs, Scream|CT, thakis ... (please check the 
changelog for details) 


